restrict access to project actions to admins only