View mailing access is not allowed for users authenticated via checksum
If you send a mailing with a link to view the mailing in your browser that includes contact id and checksum (which is what the default "View in browser" link Mosaico's Versafix template does), you would expect that you'd be able to view the mailing even if the Publication is set to User and User Admin Only. However, if you open the link in a private browsing window, you'll get access denied.
I think the expected behaviour would be that you can access the mailing when authenticated via checksum. Otherwise, that View in browser link is broken for any mailing that isn't public.
If the mailing isn't public, the page just checks for administer CiviCRM, approve mailings or access CiviMail. Maybe we need a new permission like CiviMail: access non-public mailings
or maybe we can simply allow any logged in user to view mailings (since it says "User and User Admin Only" and a logged in contact is a user).