API should return private/draft notes if authenticated.