project(): fix order of args to loc()

Really we should always pass locations as struct loc to avoid this bug, but
it's slow going with so much code passing y/x pairs.