project listing now correctly returns access control headers