BEAR answers being seen by more than one user

[RobStallion]

If a user fills in a BEAR form for a specific publication, then another user does a similar search and goes to review that same publication they will see the previous users answers.

[RobStallion]

Bug appears to be caused by the function all_questions_for_sec in bear_questions.ex. The error seems to be happening because this function is not currently checking the pico_search_id in the query.

Next step

Will add pico_search_id to the query and function calls and see if this resolves the error.

[RobStallion]

This appears to have resolved the issue. Will open a pr with the solution.

[iteles]

A related question: can a user guess at a URL (change the final digit for example) and then edit someone else's BEAR? We should maybe be checking for the user's ID.

[RobStallion]

@iteles. At the moment the routes are not protected (a user could potentially see another users answers if they guessed the URL).

I will look into this after meeting with @harrygfox and going over the changes to the BEAR flow as the changes will likely effect the way these queries are currently done.