diff --git a/BUILD b/BUILD
index 5594a52..2593ebd 100644
--- a/BUILD
+++ b/BUILD
@@ -3,6 +3,7 @@
 gerrit_plugin(
     name = "gitblit",
     srcs = glob(["src/main/java/**/*.java"]),
+    resources = glob(["src/main/resources/**/*"]),
     manifest_entries = [
         "Gerrit-PluginName: gitblit",
         "Gerrit-Module: com.googlesource.gerrit.plugins.gitblit.GitBlitModule",
@@ -10,7 +11,6 @@
         "Gerrit-InitStep: com.googlesource.gerrit.plugins.gitblit.GitBlitInitStep",
         "Gerrit-ReloadMode: restart",
     ],
-    resources = glob(["src/main/resources/**/*"]),
     deps = [
         "@commons-codec//jar:neverlink",
         "@commons-io//jar",
@@ -38,8 +38,8 @@
         "@twiki-core//jar",
         "@unboundid//jar",
         "@waffle-jna//jar",
-        "@wicket-extensions//jar",
         "@wicket//jar",
+        "@wicket-extensions//jar",
         "@wikitext-core//jar",
     ],
 )
diff --git a/README.md b/README.md
index a88175a..3289410 100644
--- a/README.md
+++ b/README.md
@@ -21,7 +21,6 @@
 
     $ git clone https://github.com/gitblit/gitblit.git
     $ cd gitblit && git checkout master
-    $ git fetch origin refs/pull/1168/head && git merge --no-edit FETCH_HEAD
     $ ant -DresourceFolderPrefix=static installMaven
 
 ### Gitblit plugin
diff --git a/external_plugin_deps.bzl b/external_plugin_deps.bzl
index 7a98cc7..9097a8d 100644
--- a/external_plugin_deps.bzl
+++ b/external_plugin_deps.bzl
@@ -136,16 +136,16 @@
   )
 
   # Lucene version must be aligned with the version in core Gerrit
-  LUCENE_VERS = "5.5.2"
+  LUCENE_VERS = "5.5.4"
 
   maven_jar(
-    name = "lucene-highlighter",
-    artifact = "org.apache.lucene:lucene-highlighter:" + LUCENE_VERS,
-    sha1 = "d127ac514e9df965ab0b57d92bbe0c68d3d145b8",
+    name = 'lucene-highlighter',
+    artifact = 'org.apache.lucene:lucene-highlighter:' + LUCENE_VERS,
+    sha1 = '433f53f03f1b14337c08d54e507a5410905376fa',
   )
 
   maven_jar(
-    name = "lucene-memory",
-    artifact = "org.apache.lucene:lucene-memory:" + LUCENE_VERS,
-    sha1 = "7409db9863d8fbc265c27793c6cc7511304182c2",
+    name = 'lucene-memory',
+    artifact = 'org.apache.lucene:lucene-memory:' + LUCENE_VERS,
+    sha1 = '4dbdc2e1a24837722294762a9edb479f79092ab9',
   )
diff --git a/src/main/java/com/googlesource/gerrit/plugins/gitblit/GitBlitServletModule.java b/src/main/java/com/googlesource/gerrit/plugins/gitblit/GitBlitServletModule.java
index b1f00bf..91197b7 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/gitblit/GitBlitServletModule.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/gitblit/GitBlitServletModule.java
@@ -61,7 +61,7 @@
   private static final Logger log = LoggerFactory.getLogger(GitBlitServletModule.class);
 
   @Inject
-  public GitBlitServletModule(@PluginName final String name) {
+  public GitBlitServletModule(@PluginName String name) {
     log.info("Create GitBlitModule with name='" + name);
   }
 
diff --git a/src/main/java/com/googlesource/gerrit/plugins/gitblit/auth/GerritAuthFilter.java b/src/main/java/com/googlesource/gerrit/plugins/gitblit/auth/GerritAuthFilter.java
index d0019b5..c1f8fed 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/gitblit/auth/GerritAuthFilter.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/gitblit/auth/GerritAuthFilter.java
@@ -68,7 +68,7 @@
   }
 
   public boolean doFilter(
-      final DynamicItem<WebSession> webSession, ServletRequest request, ServletResponse response)
+      DynamicItem<WebSession> webSession, ServletRequest request, ServletResponse response)
       throws IOException {
     HttpServletRequest httpRequest = (HttpServletRequest) request;
 
@@ -82,8 +82,7 @@
     }
   }
 
-  public boolean filterSessionAuth(
-      final DynamicItem<WebSession> webSession, HttpServletRequest request) {
+  public boolean filterSessionAuth(DynamicItem<WebSession> webSession, HttpServletRequest request) {
     request.setAttribute("gerrit-username", webSession.get().getUser().getUserName());
     request.setAttribute("gerrit-token", webSession.get().getSessionId());
     return true;
@@ -98,7 +97,7 @@
       return false;
     }
 
-    final byte[] decoded = new Base64().decode(hdr.substring(LIT_BASIC.length()).getBytes());
+    byte[] decoded = new Base64().decode(hdr.substring(LIT_BASIC.length()).getBytes());
     String usernamePassword =
         new String(decoded, MoreObjects.firstNonNull(request.getCharacterEncoding(), "UTF-8"));
     int splitPos = usernamePassword.indexOf(':');
diff --git a/src/main/java/com/googlesource/gerrit/plugins/gitblit/auth/GerritToGitBlitUserModel.java b/src/main/java/com/googlesource/gerrit/plugins/gitblit/auth/GerritToGitBlitUserModel.java
index 3802743..f00cefc 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/gitblit/auth/GerritToGitBlitUserModel.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/gitblit/auth/GerritToGitBlitUserModel.java
@@ -21,9 +21,12 @@
 import com.gitblit.models.UserModel;
 import com.gitblit.utils.StringUtils;
 import com.google.gerrit.reviewdb.client.Project.NameKey;
-import com.google.gerrit.server.project.NoSuchProjectException;
-import com.google.gerrit.server.project.ProjectControl;
-import com.google.gerrit.server.project.ProjectControl.Factory;
+import com.google.gerrit.server.CurrentUser;
+import com.google.gerrit.server.permissions.PermissionBackend;
+import com.google.gerrit.server.permissions.PermissionBackend.ForProject;
+import com.google.gerrit.server.permissions.ProjectPermission;
+import com.google.gerrit.server.permissions.RefPermission;
+import com.google.inject.Provider;
 import java.util.HashSet;
 import java.util.Set;
 
@@ -44,40 +47,38 @@
   public final Set<String> repositories = new HashSet<>();
   public final Set<TeamModel> teams = new HashSet<>();
 
-  private final transient ProjectControl.Factory projectControlFactory;
+  private final transient Provider<CurrentUser> userProvider;
+  private final transient PermissionBackend permissionBackend;
 
   // non-persisted fields
   public boolean isAuthenticated;
 
   public GerritToGitBlitUserModel(String username) {
-    this(username, null);
+    this(username, null, null);
   }
 
   public GerritToGitBlitUserModel(
-      String username, final ProjectControl.Factory projectControlFactory) {
+      String username, Provider<CurrentUser> userProvider, PermissionBackend permissionBackend) {
     super(username);
     this.username = username;
     this.isAuthenticated = true;
-    this.projectControlFactory = projectControlFactory;
+    this.userProvider = userProvider;
+    this.permissionBackend = permissionBackend;
   }
 
-  public GerritToGitBlitUserModel(final ProjectControl.Factory projectControlFactory) {
+  public GerritToGitBlitUserModel() {
     super(ANONYMOUS_USER);
-    this.projectControlFactory = projectControlFactory;
+    this.userProvider = null;
+    this.permissionBackend = null;
   }
 
-  @Deprecated
-  public boolean canAccessRepository(String repositoryName) {
-    boolean result = false;
-
-    try {
-      ProjectControl control = projectControlFactory.controlFor(new NameKey(repositoryName));
-      result = control != null;
-    } catch (NoSuchProjectException e) {
-      result = false;
-    }
-
-    return result;
+  @Override
+  public boolean canView(RepositoryModel repository, String ref) {
+    return permissionBackend
+        .user(userProvider)
+        .project(new NameKey(StringUtils.stripDotGit(repository.name)))
+        .ref(ref)
+        .testOrFalse(RefPermission.READ);
   }
 
   @Override
@@ -85,54 +86,29 @@
       RepositoryModel repository,
       AccessRestrictionType ifRestriction,
       AccessPermission requirePermission) {
-    boolean result = false;
-
-    try {
-      ProjectControl control =
-          projectControlFactory.controlFor(new NameKey(getRepositoryName(repository.name)));
-
-      if (control == null) {
-        return false;
-      }
-
-      switch (ifRestriction) {
-        case VIEW:
-          return !control.isHidden();
-        case CLONE:
-          return control.canRunUploadPack();
-        case PUSH:
-          return control.canRunReceivePack();
-        case NONE:
-        default:
-          return true;
-      }
-    } catch (NoSuchProjectException e) {
-      result = false;
+    ForProject projectPermissions =
+        permissionBackend
+            .user(userProvider)
+            .project(new NameKey(StringUtils.stripDotGit(repository.name)));
+    switch (ifRestriction) {
+      case VIEW:
+        return projectPermissions.testOrFalse(ProjectPermission.ACCESS);
+      case CLONE:
+        return projectPermissions.testOrFalse(ProjectPermission.RUN_UPLOAD_PACK);
+      case PUSH:
+        return projectPermissions.testOrFalse(ProjectPermission.RUN_RECEIVE_PACK);
+      case NONE:
+      default:
+        return true;
     }
-
-    return result;
-  }
-
-  public String getRepositoryName(String name) {
-    if (name.endsWith(".git")) {
-      name = name.substring(0, name.length() - 4);
-    }
-    return name;
   }
 
   @Override
   public boolean hasRepositoryPermission(String name) {
-    boolean result = false;
-
-    try {
-      name = getRepositoryName(name);
-      ProjectControl control = projectControlFactory.controlFor(new NameKey(name));
-      result = control != null && !control.isHidden();
-    } catch (NoSuchProjectException e) {
-      result = false;
-    }
-
-    return result;
+    return permissionBackend
+        .user(userProvider)
+        .project(new NameKey(StringUtils.stripDotGit(name)))
+        .testOrFalse(ProjectPermission.ACCESS);
   }
 
   public boolean hasTeamAccess(String repositoryName) {
@@ -202,7 +178,7 @@
     return username.compareTo(o.username);
   }
 
-  public static UserModel getAnonymous(Factory projectControl) {
-    return new GerritToGitBlitUserModel(ANONYMOUS_USER, projectControl);
+  public static UserModel getAnonymous() {
+    return new GerritToGitBlitUserModel(ANONYMOUS_USER, null, null);
   }
 }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/gitblit/auth/GerritToGitBlitUserService.java b/src/main/java/com/googlesource/gerrit/plugins/gitblit/auth/GerritToGitBlitUserService.java
index b8dcbd5..3dd0bfa 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/gitblit/auth/GerritToGitBlitUserService.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/gitblit/auth/GerritToGitBlitUserService.java
@@ -27,11 +27,13 @@
 import com.google.common.base.Strings;
 import com.google.gerrit.extensions.registration.DynamicItem;
 import com.google.gerrit.httpd.WebSession;
+import com.google.gerrit.server.CurrentUser;
 import com.google.gerrit.server.account.AccountManager;
 import com.google.gerrit.server.account.AuthRequest;
 import com.google.gerrit.server.account.AuthResult;
-import com.google.gerrit.server.project.ProjectControl;
+import com.google.gerrit.server.permissions.PermissionBackend;
 import com.google.inject.Inject;
+import com.google.inject.Provider;
 import com.google.inject.Singleton;
 import java.util.Collection;
 import java.util.Collections;
@@ -45,7 +47,8 @@
 public class GerritToGitBlitUserService implements IAuthenticationManager, IUserManager {
   private static final Logger log = LoggerFactory.getLogger(GerritToGitBlitUserService.class);
 
-  private final ProjectControl.Factory projectControl;
+  private final Provider<CurrentUser> userProvider;
+  private final PermissionBackend permissionBackend;
   private final AccountManager accountManager;
   private final DynamicItem<WebSession> webSession;
 
@@ -53,10 +56,12 @@
 
   @Inject
   public GerritToGitBlitUserService(
-      final ProjectControl.Factory projectControl,
+      Provider<CurrentUser> userProvider,
+      PermissionBackend permissionBackend,
       AccountManager accountManager,
-      final DynamicItem<WebSession> webSession) {
-    this.projectControl = projectControl;
+      DynamicItem<WebSession> webSession) {
+    this.userProvider = userProvider;
+    this.permissionBackend = permissionBackend;
     this.accountManager = accountManager;
     this.webSession = webSession;
   }
@@ -66,7 +71,7 @@
     String passwordString = new String(password);
 
     if (username.equals(GerritToGitBlitUserModel.ANONYMOUS_USER)) {
-      return GerritToGitBlitUserModel.getAnonymous(projectControl);
+      return GerritToGitBlitUserModel.getAnonymous();
     } else if (passwordString.startsWith(GerritToGitBlitUserService.SESSIONAUTH)) {
       return authenticateSSO(
           username, passwordString.substring(GerritToGitBlitUserService.SESSIONAUTH.length()));
@@ -93,7 +98,7 @@
       return null;
     }
 
-    return new GerritToGitBlitUserModel(username, projectControl);
+    return new GerritToGitBlitUserModel(username, userProvider, permissionBackend);
   }
 
   public UserModel authenticateBasicAuth(String username, String password) {
@@ -113,7 +118,7 @@
       return null;
     }
 
-    return new GerritToGitBlitUserModel(username, projectControl);
+    return new GerritToGitBlitUserModel(username, userProvider, permissionBackend);
   }
 
   @Override
@@ -133,7 +138,7 @@
     httpRequest.getSession().setAttribute(Constants.ATTRIB_AUTHTYPE, AuthenticationType.CONTAINER);
 
     if (Strings.isNullOrEmpty(gerritUsername) || Strings.isNullOrEmpty(gerritToken)) {
-      return GerritToGitBlitUserModel.getAnonymous(projectControl);
+      return GerritToGitBlitUserModel.getAnonymous();
     }
     return authenticateSSO(gerritUsername, gerritToken);
   }
@@ -210,7 +215,7 @@
 
   @Override
   public UserModel getUserModel(String username) {
-    return new GerritToGitBlitUserModel(username, projectControl);
+    return new GerritToGitBlitUserModel(username, userProvider, permissionBackend);
   }
 
   @Override