lock down specific project controller actions for admins only