The homeserver can implement its own algorithm, but is suggested to ensure the requesting user can reasonably see the other users.
The text is intentionally left vague for whether or not the API is local users only to give the homeserver some flexibility in this area.
General cleanup is also included in this commit.
Fixes https://github.com/matrix-org/matrix-doc/issues/1108