Fix authorization
do not index users unless organizer or admin
Merge pull request #556 from differentreality/abilities

Fix authorization