Assumes the search APIs have been updated - as per
- When searching, and specifically when generating the 'User' results (as opposed to 'Message' results), we need to make sure we only return those users who are either:
- Contacts of the current user or;
- Are visible to the current user, either within his course (if site-wide messaging is disabled), or in a site (is site-wide messaging is enabled).
- 'Visibility' may entail checking several capabilities, mainly those around viewing user names, or the ability to view course participants. Possibly identity fields, but hopefully not.