Owner cannot manage private org

If an organization is set as private the UI won't show the list of teams and staff. Steps to replicate:

- Create a private org at /organizations/create
- Visit organization page, it won't show "Staff Members" section
- Edit organization details, set it as public
- Visit organization page, it will show "Staff Members" section

We should look into the permissions middleware and add test coverage for this.

cc @kamicut @batpad

Start at the permissions middleware used by the organization page and the /organizations/create flow, then reproduce the missing "Staff Members" section for a private organization. Add test coverage for private-organization access and verify that owners can see the teams and staff lists.

Written by the indexing model from the issue text.