users in the project will be bound to the portal that the project was
created on. New users who join the project will also be bound to that
portal. There is a toggle on the user account page, so that it can be
selectively unset. This is quite coarse as solutions go, but I expect
its use will be very rare.