Add a member (user/organization/persona/app/token) to an access group

Authenticate every request with Authorization: Bearer <token> — a JWT or API token.