Users without 'bypass node access' permission can't reference unpublished content even if they have access to it