We already are restricting by permissions — see [here](https://github.com/cvan/galaxy-api/blob/list-statuses-fix/views/game/list.js#L61-L67).