Add raise_exception arg to @group_required

[jacobtylerwalls]

The @group_required decorator for permission checking will, when the user fails the test, redirect to nowhere with status 302.

This is fine for requests to views that render templates. But for views that return JSON payloads, I'm suggesting that better than a 302 redirect is a 403 permission denied code.

We found in AfS that returning 3xx instead of 4xx error codes resulted in no error banner in knockout components.

Will open a PR to illustrate the idea.