Return users & permisions for forms & projects

closes #335 
closes #334 
Isn't this the exact same as in project_serialized? Needs to be refactored