fix rights for API call project update