Prevent users from creating notes on resources they can't access

See https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2054