by responding with 403 to GET /api/v1/timelines/public when public is set to false
Fixes #873 (closed)