Support making places invisible

- 400 when include_invisible flag is absent
- 401 when unauthenticated
- 403 when not allowed
Support include_submissions flag

- Show invisible submissions when requested and permitted; hide otherwise