restricting access to project actions only to admins