Mp/user org associations

Note re: all TODOs - they're there intentionally as some cleanup or pending functionality (mostly due to org auth)