make projects only visible to users with permission to see them