Usage of note.visible_for?(user) for read(view) permission check
is not complete. This change replaces that check with an actual
note policy check for actuall permission checks.