only require access-token if project_type was public beforehand or when project is new
only require access-token if project_type was public beforehand or when project is new