Make sure users can only access projects that belong to them