Raises 403 if session user not in project admins list