Conduit doesn't currently have an analog to "shouldAllowPublic", so the recent policy checks added here caught legitimate Conduit calls when viewing Diffusion as a logged-out user.
Add shouldAllowPublic() and set it for all the Diffusion queries.
(More calls probably need this, but we can add it when we hit them.)