don't show projects that a user doesn't have permission to see