* Make resource creation return 400 with empty manifest
* Add project_id and user_id to db query filter