Stats access is verified after stats have been generated

The `Imbo\EventListener\StatsAccess` event listener kicks in after the stats have been generated. It should be run before the stats are generated in case the user is not allowed to access the resource anyways.