don't leak hidden profiles and private sites (admins can see them regardless, but normals should not be able to)