Direct URL permission fixes.
If user is not admin then show error 401 on companies and users controllers.
correctly removed un permitted projects from the list.