restricted project viewing to users with permission