restrict api project show to users with permission
added update action in api