lock down specific projects controller action for admins only