restrict projects controller to authenticated/authorized user