where do we actually do the filtering by `is_read`? shouldn't we change the API endpoint to do `is_read=False` by default (and then allow override via a querystring param)?