Card #226 (security) - contact unit, remove call to get child units (now use public method as in join requests), updated to more sensible controller name and REST call, /public/passwordrequest/group/{groupId}
added check for GLOBAL_ADMIN on RolesOnly
fixes for code/group tests