Fix user_autocomplete authorization
Restrict group member listing to sysadmin users
Allow organization editors and admins to view the member list
Use the sysadmin auth function directly for consistency