Group membership was editable for users themselves. Made it only changeable for admin.