The method is named wrap_authorized_projects_with_cte but we're actually
passing an arbitrary collection / query here.