Added some permissions checks to ensure that only valid media types can be posted,
and that media can only be added to a project to which the user is authorized.