Access controls for new refs and merges

Disallow receiving merge commits.  Only allow new refs from users
listed in hooks.branchers.