hide private data by default, add option to show private data

[timoweiss]

By default, the API should not expose data marked as "private". But if the requesting user requests its own data, the private date should be returned.

This applies (among others) to:

• locations
• journeys (in future)

[timoweiss]

We can add a flag show_private to the request pattern. This can be set to true if the call comes from a me/ route