Do not allow fetch data from unpublished nodes

I think this is actually a feature request and not a security release. I can come up with many examples of when showing unpublished nodes in the autocomplete would be desired

That said, I think this might be an excellent feature to include. Ill marinate