When the email is sent containing a link and requesting to add a user to a group, for example:

Click the link below to process this request:

https://esg2.prototype.ucar.edu/ac/admin/manageGroupUser.htm?identifier=14961f76-6b85-11e0-97bd-00c0f03d5b7c&gatewayName=ESG-PCMDI&groupName=PNNL

If I click that logged in as a regular user, I get ISE due to NPE in AccessDeniedController. If I'm logged in as rootAdmin, it works ok.
The ISE should be a specific message instead.