Restricting projects API show to only users who have permission to view a project