Better flow for group membership requests

It has to be a POST request otherwise the link is vulnerable to CSRF attacks.