Authz fix

This patch (with tests) applies consistent authorization checks against Collection and Items based on the current_user and the is_public status of the record.