Add sensible defaults/spec for UFGroup create api

I went back to the discussion we had about #now & other macros to try to populate UFGroup.create properly (who created & when)

I wrote the spec using the "normal" $session & date() functions, works ok.

Assigning to you see if you get a better idea (eg. obviously, setting this default is in the form & not in the bao, hence the duplication)

Also, I'm wondering if it's a good idea to let (when using ajax) the caller set the owner/date they want, but that's a way more general problem than the UFGroup only. We might need to introduce a new api.override that applies only is ajax (or check_permission in general)?