Implement organizational_permissions.deleted_at and fix some permission bugs