Set the correct project when creating new records
completely overhaul permissions checking relating to projects in the repository API