guard against logged out session when setting req.user.isProjectCreator