access-control: refactoring.

Extract isProjectResourceAllowed from isAllowed, and etc.