tweaked handlebars security
added deny directives to resource/project views