Secure Web UI for public access #201
Description
Users should only see repos they have read access to. Currently, the web UI fails for any non-LeapYear github account, since we query for private LeapYear repos
Only allow resetting merge runs for people with write access.