Centralize checking if user is part of an organization logic

- lean into SSOT for checking instead of having 2 methods if possible
- move validation under private for better scoping until
  it is needed in the public space.
- move specs for validation under the validation section