Workflow controller

Just for sanity checking, could I get another set of eyes on this?  I tried to conform to styles/patterns already established, but it's worth verifying.
I think we have to decide if we want workflow visibility to be controlled by project visibility and make a decision based on that. 

If we communicate that a project is only supposed to be visible to certain people (in the case of it being in dev, beta, or private mode), there's an expectation that other data connected to it is also probably private, and we should just make it impossible to view without proper permissions, not just hard to find. 

If we're cool with all workflows, subject sets, etc being public even for non publicly visible projects, which I think is also reasonable, then we just need to make a note say something about that during project creation.