create project REST service will fail on adding maintainer

- we flush early and that causes an update when adding the user as maintainer, which then failed on update permission check because he is not yet a maintainer