cloudapp scim

user relationship:

• original: company <-> user is one to one
• changed: org <-> user is many to many

user reprovision:

• original: always create user if not exists
• changed: add a guard before creating user, see User.allow_provisioning!, that’s say, check autojoin domains and org’s seats and scim setup before adding a member to org.