Basic organisations.

I think the check for work.owner existing is relevant for user too, isn't it?  In any case there's either a user or a org owner, never both.