Flow#query should observe permissions

[bemson]

The following should result in Flow#query returning false, but instead returns "..//".

var flow = new Flow({
  _perms: '!world'
});
flow.go(1); // true (correct)
flow.go(0); // false (correct)
flow.query(0); // returns "..//" (incorrect)

Above, "world" access is declined, once you enter the program-root state. Thus, permission aware methods, such as "go()" should return false (or otherwise, do nothing).

Flow#query is permission aware, but is returning a string - as if the query were valid and accessible. If Flow#go fails, so should this query.