We'll have circular import problems between User and Organization. That was why I put them in the same file originally (now we have it again with the `available_permissions` methods.