list cannot be seen if not published

There was a security issue in which a user could just manually type "/list/#" and be able to view a list, even if it was unpublished.