Since we support confidential epics, it's not sufficient to check user
can read the epic's group, we should check that user can read the epic
itself.