Flagged/deleted posts can be viewed even for topics where I have no access

[eviltrout (Robin Ward)]

I had to fight ActiveRecord a bit to fix this one (stupid default_scope) but I have a fix:

https://github.com/discourse/discourse/commit/db4c04d6065622bb2507b07b7cfce3bc3b63af9e