Check `/entities/<id>/provenance` endpoint for public/private return

[shirey]

The /entities/<id>/provenance endpoint appears to allow the return of private data when no token (or a valid token without HuBMAP-Read membership). Check with @maxsibilla, who noticed this, for details.

This code is in play.