[candidate_profile] Visit with user unaffiliated project appears

[zaliqarosli]

Describe the bug
In timepoint_list, the visits with user unaffiliated projects don't appear. They should not appear for those users in the candidate profile module either (but do)

To Reproduce
Steps to reproduce the behavior (attach screenshots if applicable):

1. Create a timepoint for a candidate for another project
2. Look at the candidate with a user that does not have permissions to that project
3. You will be able to still see that timepoint

What did you expect to happen?
Should not be able to see the timepoint for the unaffiliated project.

Browser Environment (please complete the following information):

• OS: [e.g. Plan9, HURD, Oberon, etc]
• Browser [e.g. chrome, firefox] (note that only these two browsers are supported)
• Version [e.g. 22]

Server Environment (if known):
Note: We only support the most recent release of LORIS.

• LORIS Version: [e.g. 22.0.0]
• Linux distribution and Version: [e.g. Ubuntu 16.04, CentOS 7]
• MySQL/MariaDB Version: [e.g. MySQL 5.7, MariaDB 10.3]

[driusan]

Pr was merged