BUGFIX: prevent 403 for proejct perms for user with only site perms