add create project endpoint and client code
fix devise authorization header cors setting; scope projects to those owned by the current user, fix authenticated user lookup by headers in api