fix allowed_to? (missing @project)