Restrict sensitive records to authorized people

[jamiefolsom]

As a community, I want some records visible only to authorized people, so that sensitive material is protected while the rest of the archive stays open.

The site-facing side of this is core-data-places#720.