Resolve "Bug: url manipulation to access course that is not yet approved / public"

Closes #99 (closed)

app/models/ability.rb

@@ -310,7 +310,7 @@ class Ability
     # For normal projects, the user can see both pending and approved projects
     # TODO: Should eventually be changed to only approved projects?
     can :index, Project
-    can :show, Project, id: Project.pending.where(course_edition_id: course_edition_ids).ids
+    can :show, Project, id: Project.approved.where(course_edition_id: course_edition_ids).ids
     can :index, ProjectPreference
 
     # For theses, the user can read thesis projects, themes and research groups