further tweaking to project permissions, expose ProjectUser resource to CLI