Some general cleanup, plus fixing a bug in the memberlist parsing code: the lists can come in in any order, so parse it *completely* before showing auth requests.
