Publish hook access

[dcrissman]

I assume we don't want 'anyone' to be able to view or manipulate the publish collection. What access should be used?

Then make that change.