#190837: User should not be able set a parent for non-subscribed group (access bypass). Thanks Amitaibu for pointing this out.