make sure specific projects controller actions are admin only