RBAC: fix behavior when project is hidden for the role