add Spotlight access control enforcement to browse and pages controllers...

... and the search model, so they respect exhibit visibility

ref #533