Prevent CSRF attacks on group adding/deleting

Thanks, ajaysinghnegi @ HackerOne!