do not skip privacy level check on unauthenticated user
We do not currently use this mixin without also requiring authentication. Still this is a potential footgun.
Note that PermissionRequiredMixin must come after this one, so in thise code the regulat authentication/permission checks have not yet run.