don't allow request from unauth users
Refactor group membership code and fix 'None'-requests.