Check for vesting_org permissions in auth