make projects only visible to users with permission