lessons learned during migratain

* close a few dangling sockets
* set perms on uploads for sec tickets
* do project checking via db not api