added additional user action authorization tests.
Also, fixed project controller for update