Remove unnecessary authorisations

Because we already check read_project ability in `before_filter :project`

See merge request !1240