Sandboxing admin of "headless zones" dummy organization

This pull request addresses issue #303.

Sandbox organization actions in the headless zones:
* Don't allow the creation of new headless zones (what would be the purpose??)
* Don't allow inviting or revoking access (just superusers)