Merge "canReadCommit: move check for READ on refs/* on top" into stable-2.8