Require at least one full/creator permission

I built this logic on the front end, but it might be a good idea to have it on the backend as well. 

Return an error if attempting to delete or demote a user's privileges if they are the last FULL or CREATOR for an event. There must be at least one user with FULL permissions.
You might want to rename `validateActivationCode` to something like `storedPermissionIsAssignable`