/api/project/create now needs login before being allowed