if there are no allowed companies, don't allow any projects
changed the default value to something safe
shifted the data-changing operations out of isValid(), it should be idempotent
removing unused variables