perform policy check before deleting association record

- perform policy check (admins group, in this case) prior to deleting
  the org_user_association record for a user. This prevents a situation
  where the user fails to delete the user record because it is in the
  admin group, but a portion of that deletion actually does occur.
- slight reorganization of user disassociation code to make intentions
  more clear
ping @opscode/server-team