create hidden links spec
Lock down specific projects controller actions for admins only