Fixes #208. Return _accessLevel when fetching a collection

This broke as a result of our filter() refactoring, and now we
verify the behavior with a test.