user upadate: add/revoke project access