Projects are visible to users with no roles

I first noticed this with the guest/unauthenticated user, because you can see everything from project groups down to build results without logging in.

http://www.nabble.com/Projects-are-visible-to-a-guest-user-with-no-roles-t2873616.html

It's the same with any other user.

Project Groups (and the projects within them) should not be visible at all unless the user has the "Project User" role for that group.

(If the user has no roles, it would be nice to display a helpful message rather than an empty list of Project Groups.)