Ensure users have at least read access to most endpoints

lib/www/server/api/index.js

@@ -94,6 +94,8 @@ app.map({
 // WARNING Every route from here onwards requires authentication!
 //
 app.use(mw.auth.authentify);
+// Read access required for anything below here
+app.use(mw.auth.access.read);
 
 // Don't process the request if the data hasn't changed
 app.use(mw.etag.ifNoneMatch);
@@ -101,7 +103,7 @@ app.use(mw.etag.ifNoneMatch);
 // We must be authenticated before we can access these
 app.map({
 	'/project': {
-		get: [ mw.project.get ],  // Get list of projects
+		get: [ mw.project.get ],  // Get list of projects, filtered by `read` access
 		post: [ mw.auth.access.admin, mw.project.post ], // Create a new project
 	},
 	'/project/:project': {