Don't send notifications to mentioned users that don't have access to the project in question.

Fixes internal issue https://dev.gitlab.org/gitlab/gitlabhq/issues/2325.

See merge request !664