Embed project name inside token

[himank]

The secrets are attached to a single project, but the token has no information about the project, which means it can be used for a different project as long as it is valid.

Embedding project information in the token will avoid it then, if the token already has a project attached to it then reject the request of performing any operation on another project like creating a project.