Implement per-project permission lookups

[jesse-gallagher]

This is done in ControllerUtil.

[jesse-gallagher]

It would be good to use this opportunity to see if there's a good way to centralize the permission checks with annotations, too.