Restrict viewer user info lookup to desk users

Website users now get a permission error from the viewer user info lookup, and desk users see the same results as before.