Ensure only authorised users can create notes on merge requests and issues See merge request gitlab/gitlabhq!3324