controller spec for project destroy permissions