changing access control, again

One thing has made me uneasy--having a restrict header in the DescriptorUnit which names the group that has write-access. This is Classifier information and may vary from Topic to Topic with no other change to the DescriptorUnit. Wrong!

So lets make restrict a Tag (which is type of Classifier) on the Topic instead. And for convenience, when a Topic is created we just copy the Tag from the parent, when present.

Now I'm happy. :-)