Modify the backend API to reject requests for published posts from Contributors

[sidemt]

As discussed in the comments on #337

[ojeytonwilliams]

Just one quick note about implementation: I think it makes the most sense to reject bad requests, rather than modify the response.

i.e. if a request comes in from a contributor asking for published posts, we should reject it, rather than sending them drafts.

[sidemt]

I was initially thinking to filter the response, but we can go the way to reject bad requests. Thank you for the suggestion!

[ojeytonwilliams]

To expand on it slightly: the rationale is just that it's easier to reason about if the api's response is predictable. It either does what you ask because you've made an allowed request or it rejects your request because you haven't.