use the requireReadAccess middleware for /api/jobs/:org/:repo
if a project is marked as "public", then it should be visible.

TODO: fix /api/jobs/:id for "public" projects.
10 minutes is too short a limit for job hang detection.
some browser tests can take up to 45 minutes.
bump this to 1 hr
make /api/job/:id honour permissions (public, collaborators, etc)