Allow multiple top containers, and expose excerpts therein

This changes the effective permission on assets with classification
EXCERPT.  The focus here is only for authorized parties.  The effect on
unauthorized parties should be revisited (esp wrt the
DEIDENTIFIED/UNRESTRICTED line).