perform policy check before deleting association record

- perform policy check (admins group, in this case) prior to deleting
  the org_user_association record for a user. This prevents a situation
  where the user fails to delete the user record because it is in the
  admin group, but a portion of that deletion actually does occur.
- slight reorganization of user disassociation code to make intentions
  more clear
ping @opscode/server-team 
OK.  I'm wondering if we should change the default behavior of `knife opc user delete` (`chef-server-ctl user-delete`) to avoid dissociation by default so that we avoid forcing the user to find every org the user is an admin in and remove them from the admin group just to delete a user.  But that decision doesn't block this at all.  Thanks for the clarification.