non-logged in users shouldn't be able to see unpublished articles

[dnaidionov]

I took a quick look at this, I think it comes down to not incorporating the session in the router.