allow project admin to authorize users
allow project admin to authorize users

This also simplifies the action a bit. It should be an error if the id
is not set on the request so throwing a exception in that case seems
fine.

concord-consortium/rigse,concord-consortium/rigse,concord-consortium/rigse,concord-consortium/rigse,concord-consortium/rigse,concord-consortium/rigse