perform policy check before deleting association record

- perform policy check (admins group, in this case) prior to deleting
  the org_user_association record for a user. This prevents a situation
  where the user fails to delete the user record because it is in the
  admin group, but a portion of that deletion actually does occur.
- slight reorganization of user disassociation code to make intentions
  more clear
ping @opscode/server-team 
            Text = <<"As a member of this organization's admin group, you cannot remove yourself from the organization.  First remove yourself from the admins group, then retry this operation.">>,