Reproduced an unwanted behaviour, instructions:
a) start a demo instance, e.g.
   ppython demo.py -b postgresql nuke
b) login as admin, create an additional user A
c) login as demo and in a different webbrowser as A
d) create a named query with demo
e) verify that A cannot see this query
f) as demo: switch the "private" on this query to now and save
Observations:
  private is still shown as "yes"
  A cannot see the search entry.
Wanted behaviour: private shown as "no" and A can see the query.

Adding the following small change makes the above test pass.
-class HTMLInputMixin:
+class HTMLInputMixin(object):

Interesting enough, in an old installation, setting a query to non-private
worked, so it got broken somewhere.