- Extract all common {push,merge} access level model code into the
  `ProtectedBranchAccess` module

- Use the HTTP verb to define controller specs