don't show project to user without permission