Add permission checking to shortlink

In order to not leak details about an unpublished
post via the post’s URL, shortlinks check permissions
and return 404 if user is not allowed to see post.