Fix api leaking notes when user is not authorized to read noteable