LDEV-662: courseAdminCanAddNewUsers and courseAdminCanBrowseAllUsers are now 1-1 with the 'create new user' and 'add/remove users' buttons. Used to need the canAddNewUsers permission before admin/manager would see the 'add/remove users' button.
fix bug where sysadmin could add userOrganisation rows to the same org indefinitely because the userOrganisations were not being added to organisation's attached Set.