Obey permissions when retrieving object by UUID.

closes #1871
In collections.create, set owner to root and add a permission link
rather than setting owner to current_user. This gives the expected
behavior when two different users create identical collections: both
users can read the resulting object.

closes #1870