Our `get_draft()` method has two modes. If no arguments are given, it will always return the existing draft. If a user was passed in, we'd return the draft only if the review request was owned by that user. In some places, we were fetching the draft using the no-args version and then doing our own access control checks. We also had at least one bug that I remember where we were passing the user in and it broke the ability for admins to reassign review requests, because we weren't fetching the draft for them in the publish operation. This inconsistency was also making it so we were showing admins the draft data, but they were unable to load draft diff fragments. This change makes it so when passing a user in to get_draft(), we will return the draft if that user has access to the draft, not just if it matches the owner of the review request. Testing Done: - Ran js-tests. - Verified that as an admin I could now view *all* draft data on a review request owned by another user. - Audited calls to get_draft() to ensure that everything was using it in the correct way.