Don't allow guests to see merge requests

It's a bit pointless to see merge requests if you can't browse the code.