We were calling `.where` and `.send` on the relation, but never doing
anything with the return value, resulting in proper access-level
filtering never being of any consequence.