lock down specific projects controller actions for admins only BUT tests is not working