REST to not show unlisted items in Collection item list, fixes DS-1976

This also introduces ItemService.isItemListedForUser, a service method that
can be a central piece of code that checks if Item is READ, and listed
DS-1976 Don't list private items in new REST endpoints

Private items are listable to admin, not to other users
These are new endpoints from REST CRUD
Merge pull request #527 from peterdietz/DS-1976-rest-unlisted-items

REST to not show unlisted items in Collection item list, fixes DS-1976