Fix GET post mentions authorization
Restrict post.received_at/post.version.received_at/post.app.id to apps