Pull Request mentions show users that don't have access to the project / repo

Current behaviour / steps to reproduce:

Take the following setup into consideration:

• users: john@lorem.com and alice@ipsum.com
• group: lorem-contributors
• project: builder
• repo: web

User alice@ipsum.com is not part of any group / doesn't have access to any project / any repo / any group (except stash-users for login access).

User john@lorem.com is a member of group lorem-contributors
Group lorem-contributors has PROJECT_WRITE access to project builder (so they can create Pull Requests).

When user john@lorem.com creates a PR, he can mention @al in the PR's description field and user alice@ipsum.com will be displayed, even if she doesn't have any access to the project / repo / group.

Expected behaviour:

When mentioning users in the Pull Request description field, only users that have access to that repo / project should be displayed as autocomplete suggestions.