Basic checks on organizations controller, restrict routes
Add organization_owner attribute to users