Routes manifest is returning IRIs of draft components that a user does not have access to

[silverbackdan]

We should probably not return these IRIs as it will cause the front-end to hit 404s trying to fetch these resources if not permitted.