Better relational create/update, and Organization#security_officer

cc: @chasballew, you may want to refactor the places where you repeat logic to determine the `security_officer`. If and when we change this logic, `aptible-auth` will be the authoritative source.