[WIP] Remove authentication logic from project filter

It is confusing to have a setter method also do authorization:
all authorization methods should start with authorize_

This is a better alternative than https://github.com/gitlabhq/gitlabhq/pull/8099, but harder to make sure that it is correct.