the page project/<ID>/admin/references
availability only depends on project visibility
This does not leak information, as references can be listed on REST route,
but it might be disturbing for users to have access to this page in read only (CRUD action are listed, but nothing can be performed)
It's better to hide this page