user can add project (security fix also), change tests to run as user, also check access for manager and admin.