Don't set before or after to things that were dropped from a listing

This stops listings from leaking the presence of things that a user
may not view.
Don't show 'next' button if there are less than `limit` visible items

This clears up an info leak where an attacker could tell if there
were more items than visible items on the last page of a listing.
Move Builder.get_items wrapping logic to convert_items
QueryBuilder.get_items cleanup
builder: Lookup orig_items by _id.
Verify permissions for the `after` parameter in listings

This plugs an info leak where an attacker could test whether an item
was present in a listing even if the user was not allowed to view it