added extra security: index, new and delete restricted to logged in users
Added controller check so each user can only access their own projects and shifts