Do not check if the user can read project in the notify action of the
alerts_controller because that API is hit by alertmanager, and there
will never be a user signed in. Project access will be checked in
the NotifyService which checks if the alertmanager token in the request
matches the token in the DB for the given project.