I would consider moving the can_invite() and is_member() checks outside of of approve_deny_application().  It was a bit confusing to me to think about what happens if the checks work for one application, but not the next.  I now get that if it passes once, it will always pass, but it still seems more clear to me to check once before the loop.