I was suggested to add a policy to check project token log in ability,
but that's breaking things with container pulling, so removing policy
code and doing more explicit permission checks instead.