Completed post & user list filer by role

closes #3446, closes #3086

- Authors can only ever get to their own posts
- Editors only ever see authors in the user list