These should be forwarded, TODO removed
Updated project validation status code to 401

While 403 is probably the better choice, we will be using 401 to maintain backwards compatibility with the client authn filter. Additionally, an Identity v2 service would return a 401 to a ?belongsTo call if the projectId did not match.
Implement bypass project ID validation