Web access controls

Embargos can be confusing, because we want to differentiate between "is active" and "should be active, but a user hasn't activated it yet"