Resolve "shapes endpoint should not require authorization if we can view project"

Closes #2109 (closed), #2105 (closed), #2107 (closed), #2106 (closed)