Don't embed memberships unless requested

This changes the way that memberships are embedded with the ?embed
parameter. If you just provide 'membership' then the first layer of
memberships are populated (the default behaviour), 'membership.person'
will populate the people in the first layer of memberships, but not
those peoples memberships, 'membership.person.membership' will populate
the people's memberships as well. The same goes for organizations.

I've changed the embed population to be a mongoose plugin, which
tidies up the code in src/app.js a bit to just call a method on the
model.

I've also removed the recursive membership population in favour of using
the async module, which makes it a bit easier for my brain to grok.
Check that enough targets have been found