[api] fix review users for projects and packages

Fixes issue #817 and is more complete than #818