This has been broken since 34457b30, when the feature was implemented: a user
who can merge the MR may not have access to push to the source branch, and vice
versa.

This makes the backend check the correct thing (which the UI already did):
whether the user can push to the source branch.