Issue hidden project to auth

This PR moves all the authorisation responsibilities out of the views to the auth modules. It also adds tests that we were lacking for the authorisation of the resource 'apps/projects'.
In addition to that, some tests have been modified to reflect the fact that an anonymous user requesting a resource that may or may not be authorised to access once he/she is signed in, should be getting a 401 and not a 403, which will be eventually raised once the identity of the user is known, if ever.

Refs #717