added additional permission checks
refactored permission check for groups to use @PreAuthorize annotations
fixed a bug cause of which users could not accept invites