Track updates to project membership.
Add spec to ensure rejection of invalid requests is working on the controller.