Relax volume creation and tighten sharing

Partially see #1117, though permission checks are incomplete (does not
let delegated users share).