Can this be restructured in a way that doesn't need an embedded function like this? Maybe we could have a function like `_getContentAccess` that takes care of determining things like `isManager`, `isViewer`, `canShare`, etc... Similar to discussions: https://github.com/oaeproject/Hilary/blob/master/node_modules/oae-discussions/lib/api.authz.js#L269