perform policy check before deleting association record

- perform policy check (admins group, in this case) prior to deleting
  the org_user_association record for a user. This prevents a situation
  where the user fails to delete the user record because it is in the
  admin group, but a portion of that deletion actually does occur.
- slight reorganization of user disassociation code to make intentions
  more clear
ping @opscode/server-team 
Is it safe to delete a user (DELETE /users/USERNAME) without dissociating it from every organization first?  The following commit in knife-opc from a member of support: 

   https://github.com/opscode/knife-opc/commit/115d6d8ea8abbe90052c0d5c0aa20359bcadea0e

leads me to believe that at one point there was probably a problem with this.  Given this change, it looks like we would first have to check every organization, see if the user is an admin, remove them from the admin group, then dissociate, and then remove the user.

If we can safely just do the user delete and skip this dissociation loop, then I'm less worried about it.