Return users & permisions for forms & projects

closes #335 
closes #334 
moved the repeated code to permission namespace