docs: def can_update(self, user, **data):
          """
          Sys admins can always update an organisation.
  
          Organisation admins and creators can update, but may not update the following fields:
  
              - star_rating
  
          :param user: a User
          :param data: data that the user wants to update
          :returns: bool, set of fields that the user was not authorized to update
          """
          if user.is_admin():
              raise Return((True, set([])))
  
          org_admin = user.is_org_admin(self.id)
          creator = self.created_by == user.id
          if org_admin or creator:
              fields = {'star_rating'} & set(data.keys())
              if fields:
                  raise Return((False, fields))
              else:
                  raise Return((True, set([])))
  
          raise Return((False, set([])))