make sure the rest api does not grant access to restricted projects