Check that the provided token is valid against the desired project
    
    At this point we checked that the token:
    - exists
    - has not expired
    - is allowed to access this endpoint (which might mean, depending on the
      endpoint, is allowed to perform the action)
    
    But we had not checked if the token is allowed to all this on this
    project, this is now rectified