Lock some project controller actions to admin