I feel like this is a bit of a security issue... Maybe it's actually a security issue with this entire controller. We're authenticating the user, but not checking that the user actually owns the project. Also, this is a destructive operation and needs confirmation.