do not allow users without organization access get viewer status

@steved555 
We could probably short circuit some logins by checking this first, but it's fine