Fix before_action order: find_project must run before authorize