Fix: don't put private loadouts in the sitemap.

Thankfully the private URIs did not include the secret token, they
just returned 403s.