Return search results the caller can actually read

Drive search now filters permission before pagination instead of after.