controller spec for project edit permissions