- check if user has manage access to project
- don't cache result of authorized_projects, because it's serialised with User object
- clear user sessions