perform policy check before deleting association record

- perform policy check (admins group, in this case) prior to deleting
  the org_user_association record for a user. This prevents a situation
  where the user fails to delete the user record because it is in the
  admin group, but a portion of that deletion actually does occur.
- slight reorganization of user disassociation code to make intentions
  more clear
ping @opscode/server-team 
Maybe change 'delete themselves' to 'remove themselves from the organization'. While 'association' wasn't a great term, it at least was distinct from deleting the user.