Move to a superadmin > organization permission structure

[ben-pr-p]

Although the need arises from multi-tenant instances, I think this is a cleaner permission structure overall, and solves some odd things currently going on about invitations.

I propose:

• The first user in an instance is the superadmin
• The superadmin is the only one with the power to create or destroy organizations
• The superadmin can invite other admins

I'll do a survey of the code sometime in the next week+ and document here the changes that this would require

[schuyler1d]

1. I think first user in an instance is the superadmin is fine, as long as it's documented clearly as part of the startup.
2. If you turn SUPPRESS_SELF_INVITE=1 on, then no one can create an organization. I support some interface where a superadmin CAN create an organization
3. I think this is already possible though is more a two-step process (first they need to be invited and accept, and once they've logged in you can promote them to an admin or owner)

[ibrand]

@schuyler1d what ended up happening here? Do we still want this to be implemented?

[schuyler1d]

Nothing.