Orgs: Use create-organization capability to control access

This is more explicit and future-proof than checking for admin cap.

pillar/api/organizations/hooks.py

@@ -18,7 +18,7 @@ def pre_get_organizations(request, lookup):
 
 def pre_post_organizations(request):
     user = current_user()
-    if user.is_anonymous or not user.has_cap('admin'):
+    if not user.has_cap('create-organization'):
         raise wz_exceptions.Forbidden()
 
 

pillar/config.py

@@ -167,5 +167,5 @@ USER_CAPABILITIES = defaultdict(**{
     'subscriber': {'subscriber', 'home-project'},
     'demo': {'subscriber', 'home-project'},
     'admin': {'subscriber', 'home-project', 'video-encoding', 'admin',
-              'view-pending-nodes', 'edit-project-node-types'},
+              'view-pending-nodes', 'edit-project-node-types', 'create-organization'},
 }, default_factory=frozenset)