Deny list access unless it's specifically allowed.

We weren't properly checking permissions around listing of models.

We will need to bump version (if following semver) because it's technically backwards incompatible.

Before we do that, today I'm going to be changing the API (again) to list view, so might as well do them both at once.