AT:

• if a user lacks row-level security permission on reports (no access to definition) the entity should not be part of the {data.entities}

  array

• this change however doesn't affect the entity counts visible in the home page, they will always show the total numbers regardless of authorizations (this is agreed with Andreas as we anyway want to tackle the visibility in the next iteration and tend towards showing reports with the indication that permissions are missing to access)