Any authenticated user of an organization should be able to
- search its organization's users
- search its organization's users
- retrieve a single user of its organization (this how it was
  implemented earlier)