Cases where external users can still create projects in personal namespaces
This is a tightening, following up onto #256 (closed), where we were more concerned about the UX aspect of the question.
It can still happen under special circumstances that external users (or more generally users that have exceeded their project creation quota) can still create project in their personal namespaces. It can also happen if users don't have creation rights anywhere.
introduced tighter checking in the application code
avoid presenting the creation option if possible
thanks to @dan for reporting directly this to me.
This is a security issue, even if mild.