Ensure the API doesn't return notes that the current user shouldn't see