Allow groups and containers to be indexed by either of 2 keys
clients created w/org do not own themselves;
containers created w/org do not follow org rules
Move owners_of to AclBase
Build full acls for groups; don't give new container objects
any groups by default
Get rid of owner storage, move to explicit container acl model
Delete acls when object is deleted
Don't merge acls if the user has set acls
Don't merge container/container ACLs for new containers