Web access controls

> Yes, future work is to refactor Embargo and Leases and Embargoable. Embargoable previously had everything intertwined. This is the first step in separating them.

What I mean is it seems like the logic for "what does under embargo mean" shouldn't live here, and rather with the embargo object. Just delegate down to the embargo object and your API stays the same.