@username autocomplete displays unauthorized users (BB-7840)

For projects with access restricted to only a team, the pull request's assignee field should only show the team members. Current behavior is to show any matching user, seemingly autocompleting from some global Bitbucket user list.

Although autocompleting an unauthorized user isn't allowed (Bitbucket properly says "John Smith does not have access to view this pull request"), it's still disconcerting to see total strangers pop up in the autocomplete list.

To duplicate, create a pull request (for a restricted access project) and slowly type in a few characters in the assignee field. You should see unauthorized users show up.