Improve volume access checks

Don't let people remove their own ADMIN access.  Allow authorized
affiliates of PIs to share.  Fixes #1201