Don't assume the CurrentUser can see a CustomField passed to Create

In e092e23 we started checking LookupType during Ticket creation to
avoid trying to add Transaction CFs to the Ticket (and vice versa).
Unfortunately, this assumed that the CurrentUser could Load and see the
custom fields passed to Create.

It was helpful to be able to set a default CF on create that a user
can't change later (meaning they weren't given ModifyCustomField or
SeeCustomField).  In particular, RTIR uses this to set Constituencies
during email and web UI creation.  This causes ticket creation to fail
if an Unprivileged user sends mail to an RTIR instance using
Constituencies.

Walk around the ACL since all we really want to do is parse the
LookupType for the Custom Field to make sure we're firing on the correct
Type of CFs.
Merge branch '4.2/customfield-visibility-on-create' into 4.2-trunk