Permissions: Fix Project.for_username() to work with User