Per earlier XSS fix, groupName was being URL-encoded twice; updated to
use local variable that has already been properly encoded.