users can only see tasks within projects