Only organization admins can rename an organization

Organization updates now check for an admin on every request. Before, a name-only PATCH /v1/orgs/{org}, the request the settings page autosave sends, skipped the admin check, so a non-admin member could rename a non-default organization. Such a request now returns 403 and nothing is saved.

Admins see no change. See #3315.