Do not allow member request if user is not a member of that group

[ghost]

It should not be allowed for a user to request members of a group she is not a member of.

/people/admin/foo

This is only supported if "admin" is a member of group "foo", if not a 404? should be returned.

Specification says this:
If the specified user is not a member of the group an error response with code 403 Forbidden is returned. The error field contains not_a_member. This response MUST be returned when the user is not a member, no matter whether the group actually exists or not;