restrict project actions to admins