Our get_draft() method has two modes. If no arguments are given, it

will always return the existing draft. If a user was passed in, we'd

return the draft only if the review request was owned by that user.
In some places, we were fetching the draft using the no-args version and

then doing our own access control checks. We also had at least one bug

that I remember where we were passing the user in and it broke the

ability for admins to reassign review requests, because we weren't

fetching the draft for them in the publish operation. This inconsistency

was also making it so we were showing admins the draft data, but they

were unable to load draft diff fragments.
This change makes it so when passing a user in to get_draft(), we will

return the draft if that user has access to the draft, not just if it

matches the owner of the review request.

Ran js-tests.
Verified that as an admin I could now view all draft data on a

  review request owned by another user.
Audited calls to get_draft() to ensure that everything was using it in

  the correct way.