Refactor ASM-based redirects

[ranweiler]

If a user should be unable to access a client-side URL path because of the current ASM state, this logic should all exist in one place, somewhere near the RootContainer. As it is, we have it scattered amongst the few top-level page containers that enforce such constraints.