Arvados

See #3036, which will make this story irrelevant.

Currently, it is possible to have a collection in a project (i.e., a name link has tail=project head=collection) with no corresponding permission link. This means a user can be in the position of having can_read permission on the project (therefore see a link to a collection in Workbench) but not having can_read permission on the collection itself (therefore the link yields 404).