added auth and removed json from project_groups controller. additionally added constraint to projects and plans controllers that all actions must be authenticated through pundit