this just moved out of models, and then i changed it to use `user.project` to avoid a db round trip