Fix potential infinite loop in user.get_requests

Simplified SQL and added a (shudder) extra SQL statement in a loop to
fix the larger issue.