Return users & permissions for forms & projects

closes #390