It should not be allowed for a user to request members of a group she is not a member of.
/people/admin/foo
This is only supported if "admin" is a member of group "foo", if not a 404? should be returned.
Specification says this:
If the specified user is not a member of the group an error response with code 403 Forbidden is returned. The error field contains not_a_member. This response MUST be returned when the user is not a member, no matter whether the group actually exists or not;