use addTag('node_access') and dynamic queries instead of $cond

The addition of $cond into queries is not great since none of the strings inside the condition are being filtered. The risk is reduced by the nature of node machine names, but it would be ideal to do more filtering.

There's also no node_access in the D7 version. Since this module doesn't show data from the nodes, that's OK, but it could lead to situations where someone clicks "next" and gets nothing.