Basically this is already there - permissions checks for most of our actions requires user's organization. This extra filter would need to be added to all controllers except user_session I guess. It's an extra check and we will be moving towards db-stored sessions which are more secure I believe. So I tend to prefer explicit logout which I can implement quickly.

I accept this creates a "window" where some forms could be potentially submited after org deletion has started, but I dont think this is a big issue.

If you insist on explicit check every request, I can look on it to see what can I do with it.