Will handle in a separate PR. There are a lot of places in CVD API controllers that are missing org, etc.