Security: Basic validation for membership adding

Don't allow the hackers to assign arbitrary
group membership to anyone they want.