added a bunch of tests verifying that users cannot do things to other people's projects