If a project is part of a group, then group members have implicit
access. Our current description of "private" group doesn't make this
obvious.