Hi Colin,
Freemarker gets a little upset when you try to access "missing" values. If first_name is undefined by the time you get to the last line, it means that the the assignment statements were never executed. Which in turn would mean that allowed is not being assigned a value of "true" in the first REST call.
This could be due to a couple reasons. First, I think we may need to tweak a few of your statements to use ${env.context.message.author.id?c}, in order to obtain the id of the user for the REST API calls.
Second, this could also be due to the user's privacy preferences. I know you mentioned previously that you were comfortable with showing the user's first and last name anyway, so you could potentially remove the "allowed" check. My suggestion, though, would be to leave it in and allow users to set their own privacy preferences. In this case, you'd probably want to add an else statement to handle what happens if they aren't allowed to view the first and last name.
So all in all, it might look something like this:
<#assign allowed=rest("/users/id/${env.context.message.author.id?c}/profiles/name/name_first/allowed").value />
<#if allowed?trim == "true">
<#assign first_name= rest("/users/id/${env.context.message.author.id?c}/profiles/name/name_first").value!"" />
<#assign last_name= rest("/users/id/${env.context.message.author.id?c}/profiles/name/name_last").value!"" />
${first_name} ${last_name}
<#else>
${env.context.message.author.login}
</#if>
Like Kaela's code, this sample code is intended to get you going in the right direction. It's not been tested out, and you may need to tweak a bit to suit your exact needs.
Here are the references for the concepts I mentioned in this post:
I hope this helps!