function requireProjectAdmin(req, res, next) {
  if (!req.project) return res.status(404).send('Project not loaded');
  if (!req.user) return res.status(401).send('No user');
  const isAdmin = req.user.account_level && req.user.account_level > 0;
  const notAuthed = (!req.accessLevel || req.accessLevel < 2) && !isAdmin;