add authorization requirements for projects_controller actions