Implement review feedback from @DouweM.

1. Check if a project is readable by the current user when fetching
   users for autocomplete.

2. Remove duplication relating to gon variables in
   `ProtectedBranchesController`

3. Remove unnecessary colons in view labels.

4. Remove an explicit `false` check in the `branches` API.

app/controllers/autocomplete_controller.rb

@@ -2,6 +2,7 @@ class AutocompleteController < ApplicationController
   skip_before_action :authenticate_user!, only: [:users]
   before_action :load_project, only: [:users]
   before_action :find_users, only: [:users]
+  before_action :load_project, only: [:users]
 
   def users
     @users = @users.non_ldap if params[:skip_ldap] == 'true'
@@ -55,9 +56,8 @@ class AutocompleteController < ApplicationController
     return if params[:project_id].blank?
     return if ability.blank?
 
-    project = Project.find_by(id: params[:project_id])
     @users.to_a.
-      select { |user| user.can?(ability, project) }.
+      select { |user| user.can?(ability, @project) }.
       take(Kaminari.config.default_per_page)
   end
 

app/controllers/projects/protected_branches_controller.rb

@@ -26,7 +26,7 @@ class Projects::ProtectedBranchesController < Projects::ApplicationController
 
   def show
     @matching_branches = @protected_branch.matching(@project.repository.branches)
-    gon.push(access_levels_options)
+    load_gon_show
   end
 
   def update
@@ -82,4 +82,10 @@ class Projects::ProtectedBranchesController < Projects::ApplicationController
     params.merge!(current_project_id: @project.id) if @project
     gon.push(params.merge(access_levels_options))
   end
+
+  def load_gon_show
+    params = {}
+    params.merge!(current_project_id: @project.id) if @project
+    gon.push(params.merge(access_levels_options))
+  end
 end