when admin self-removal fails, nothing should break

* ensure that after an admin user fails to disassociate, that user's
  access still works as it should.
* ensure before/after in these tests are :each so that we start each one
  in a known clean state.

Requires https://github.com/opscode/oc_chef_wm/pull/107 to pass