Ensure that only privileged users can access merge requests in the API

See merge request !2053