fix a few major permission holes

atlas/filters.py

@@ -12,6 +12,7 @@ from .models import (
     Subspecialty,
 )
 from django.contrib.auth.models import User
+from django.db.models import Q
 
 
 def get_authors(request):
@@ -118,7 +119,7 @@ class CaseFilter(django_filters.FilterSet):
     ):
         if not request.user.groups.filter(name="atlas_editor").exists():
             queryset = queryset.prefetch_related("author").filter(
-                author__id=request.user.id
+                (Q(author__id=request.user.id) | Q(open_access=True))
             )
         super(CaseFilter, self).__init__(
             data=data, queryset=queryset, prefix=prefix, request=request