Restricting project api to view a project