Restricting applications OAdmin can give access to

When inviting or editing a user, an Organisation Administrator
can only see Applications listed that have their "signin"
permission's "delegable" flag set to true.
Some tests around Application scopes
Making variable and method names less ambigious
Restricting permissions that OrgAdmins can give