Remove ability to edit user organisation & email

Also tighten up the mass assignment protection for User and fix a few
tests that were using User.create and falling foul of the new changes.