project.commtrack_enabled has a default value.
login_and_domain_required() always sets request.project, and ProjectReportDispatcher's dispatch is decorated with it.  Therefore this is ok.