Currently in get_items() in the post type controller uses is_user_logged_in to determine if non-public status should show, however this is not a good indicator of privilege. We should use some cap check instead.