do not allow users without organization access get viewer status

@steved555 
Will just doing #88 link properly?