Legal API: missing authz check on temp reg numbers

1. login to Dev as staff (account 3040)
2. create a draft IA
3. save it -- this succeeds
4. record the URL for later
5. login to Dev as BCREG0020 (account 668)
6. go to the URL for the draft IA above
7. observe that the draft IA opens -- **this is incorrect**
8. save it -- this correctly fails with HTTP 401

So the issue is step 7: because this draft IA is not affiliated with account 668, account 668 should not be able to fetch the filings, but this actually works.