use request.membership instead of passing it in. closes #600