Public search query: read-only scoped tokens published content filtering privacy