Handle `notification_id` query param gracefully for request show

There is no need to block users from viewing a request when
someone is sharing a link from his notifications with the
`notification_id` attached as a query param. The `notification_id`
query param is used to render the notification toolbar for an
authorized users. If someone without authorization is using the
same link, we should simply not render the toolbar, but still show
the request show view.