filter query search results if user is anonymous

[markmacgillivray]

currently, calls to /query return results as normal. but if the user is anonymous, a filter should be added so that only results where not private are retrieved. this does not matter for now, but will once we add more content.

note that query strings are currently passed from the javascript to /query as GET params, under the "source" param, although JSON posts should work too. This probably needs some updating, as it was due to moves away from pyes (the dao is simplified now, but may need some work on query handling).

[markmacgillivray]

query endpoint improved, dao query functionality improved, anonymous filter added to query endpoint, config setting added to control whether or not anonymous filter should be applied to query results