Expose excerpts without site authorization, just VIEW volume permission

This makes scala permissions consistent with database checks, and hopefully closer to intent.
See #1163.  Also fix some other asset checks, and use filesystem for
timestamps to avoid many low-value database calls.