fix(backgrounds): disallow equipping unowned bashground

Also add missing headers when recording group task creation

website/server/controllers/api-v3/tasks/groups.js

@@ -68,6 +68,7 @@ api.createGroupTasks = {
         category: 'behavior',
         taskType: task.type,
         groupID: group._id,
+        headers: req.headers,
       });
     });
   },

website/server/libs/user/index.js

@@ -97,7 +97,9 @@ function checkPreferencePurchase (user, path, item) {
   const itemPath = `${path}.${item}`;
   const appearance = _.get(common.content.appearances, itemPath);
   if (!appearance) return false;
-  if (appearance.price === 0) return true;
+  if (appearance.price === 0 && path !== 'background') {
+    return true;
+  }
 
   return _.get(user.purchased, itemPath);
 }