continuing work on authorization, projects should have appropriate authorization now, some source (hasn't been tested fully)
added authorization to notes, made User#user_read? private
most of the authorization in place
users can now opt-out of global search