only PIs can update users on a project