Only include shared users if the request user is the query owner

This also includes new tests to make sure shared_users is removed when the requesting user is not the owner.