This controller gets hit when you're just typing stuff in a tokenizer, too, which is latency-sensitive. Although doing policy checks normally shouldn't be slow, this endpoint is one of the most important to keep responsive.

Particularly, when $class is set and the request is AJAX (by far the most common case), we only need to filter one source (and we don't really "need" to filter it, but it's probably good to do it).

As written, this will filter everything every time in a somewhat-inefficient way. Instead...

If we hit this, just check $source. This is "probably" not necessary, but desirable to add for completeness and safety.

Do the full-list check here, at the last moment before we generate $options. That way, the code won't even run on the common path (generating real typeahead results). It's fine to do it not-totally-efficiently here since it's only impacting the debug view.