Restricting projects API show to only users who have
permission to view a project