Every public sign-up starts safely as a regular user. Organization permissions are never self-assigned.
