changed so only owners can edit memberships and projects with controller protection