restrict access to project action to admins only