Admin can assign capabilities to an org (fixed - added primary key to join table)