bounding box queries don't use private coordinates, even for obs you have permission to see

[kueda]

@alexshepard was trying to include the true coordinates of observations in the iOS explore tab for your own observation (see inaturalist/INaturalistIOS#137 (comment)) and ran into this problem: if you use the API to make an authenticated request for obs in a bounding box and you have an obs with private coordinates inside the bounding box but public coordinates outside of it, you don't get that observation back in the response, b/c we use public coordinates for bounding box queries: https://github.com/inaturalist/iNaturalistAPI/blob/master/lib/controllers/v1/observations_controller.js#L504

Here's an example request on the website: http://www.inaturalist.org/observations?nelat=37.782408483538376&nelng=-122.46629903639223&place_id=any&swlat=37.78124254829675&swlng=-122.46964911545183&verifiable=any

That doesn't include http://www.inaturalist.org/observations/6093011 for alex when he's authenticated as himself.

Not entirely sure this is a bug, but it seems like you should at least be able to include your own observations. Alex pointed out that we could theoretically overselect by using the private_geojson and removing all the obs the authenticated user doesn't have permission to see, but that may or may not be performative.

[pleary]

FWIW, not a bug, just something we never implemented. This will be relatively easy on the data end by just adding a bunch of extra ES query logic, but it'll be much trickier if we want to generate map tiles of the private coordinates. That'll involve editing https://github.com/inaturalist/elasticmaps . I can work on this if we want - I'll just need to know how high priority it is for the map tiles to use private coordinates