restricting project actions to admins only