fix checks for empty values
update ocfv changes debug output

Make it consistent with what _show_user_info outputs.
Ensure that CF's are processed in a stable order
Find group members who are Disabled so that we don't try to add them again

Otherwise Disabled users in RT who are still in an LDAP group being
imported may cause errors like:

    Failed to add <user> to <group>: Group already has member: <user>
Merge branch 'find-disabled-members'
Merge branch 'usercf-values'