controller spec for project index permissions