Streamer/Websocket does not check if the streaming user is owner of a list
The Streamer/Websocket (2.0.4 or develop now) doesn't verify if a list is owned by the user who asks to stream it, so it can leak private posts if you stream a list created by someone else. (Unless I'm mistaken, but nothing in the Streamer namespace prevents this).
MR incoming (noticed this while moving topic expansion/checks from WebsocketHandler to Streamer, for SSE). i'll split it up with the SSE MR so it could be easily backported to the old Streamer.