perform policy check before deleting association record

- perform policy check (admins group, in this case) prior to deleting
  the org_user_association record for a user. This prevents a situation
  where the user fails to delete the user record because it is in the
  admin group, but a portion of that deletion actually does occur.
- slight reorganization of user disassociation code to make intentions
  more clear
ping @opscode/server-team 

https://github.com/opscode/oc_chef_wm/blob/master/src/oc_chef_wm_named_user.erl#L239

Under SQL we have a cascade delete rule in place, so that associations and invites will automatically be deleted when the user record is deleted.  That is a new behavior under CS12.  However, because the user object was no longer valid, I don't think there is any visible difference - should not be possible to see a user that has been deleted from the system in any org under 11 either. 


There is no check of membership - so admin or not, the user gets deleted. This is the same behavior from 11. 

The user's authz data is left behind, though, including USAG and the groups that the USAG is a member of.  The data is inaccessible (the user is no longer in the system) but needs cleanup as a result.