Added the ability to explicitly forbid access to projects

This PR adds the ability to explicitly forbid access to given projects.

Fixes #3344 and #3345.
why do we need it for?
probably for future?
```
if root_permissions.count():
    user_projects = ALL_PROJECTS
else:
    user_projects = set()
```