Unpublished content gets indexed when changing security settings

Description

Steps to reproduce

1. Create a new page, but do not publish.
2. Change the page's security settings.
3. The page is indexed.

This is a problem if you use the search API directly without using any Episerver built-in filtering for visitor. It is not possible to reproduce this in the Alloy site.

Note: You can use Luke to open the index and view the indexed data.