Combine cross_reference_not_visible_for? and visible_for? methods
into a single one and adjust specs accordingly. Given that we moved
read access to policy check we do not need all the methods either.