updated permissions and DB logic so published lab results are visible when allowed to be