perform policy check before deleting association record

- perform policy check (admins group, in this case) prior to deleting
  the org_user_association record for a user. This prevents a situation
  where the user fails to delete the user record because it is in the
  admin group, but a portion of that deletion actually does occur.
- slight reorganization of user disassociation code to make intentions
  more clear
Merge pull request #107 from opscode/mp/remove-user-fail-safely

perform policy check before deleting association record
return org guid from db for user association list

To ensure backwards compatiblity with existing tools that
consume the user association API, we must return the
organization guid along with short and full names. This change
consumes the SQL query in oc_chef_authz that has also changed
to support this feature.