NR UI: staff cannot open user's NR

I am not sure if this is a requirement or even desired, but I expected this would work (ie, same as the other Entity UIs) and it doesn't.

As a staff user,
When I am logged in to the BCROS domain
And I try to load a NR using its "paid URL"
Then I expect the NR to load and display
So that I can see the same thing the user is seeing.

Instead I get a 403 (Forbidden) error.

Sample paid URL: https://dev.bcregistry.ca//namerequest/nr/2262379/?paymentId=1335&status=UEFZTUVOVF9DQU5DRUxMRUQ%3D

Workaround: load the NR using the NR number and the user's email address or phone number for authentication.

Start by reproducing the NR UI request with the sample paid URL while logged in as a staff user in the BCROS domain, then trace the authorization path for that entry point. Done means the paid URL loads the NR for staff and displays the same view the user sees instead of returning 403.

Written by the indexing model from the issue text.