This should be
`delete_form=DeleteGroupForm(self.request, formdata=self.request.params)`

to pass the CSRF token.  And the delete_group handler (in groups.py) is missing delete_form.validate() check