## Bug description

Since users can now be part of multiple projects, the `get_team_from_token` function used in capture and decide endpoints cannot work reliably with personal API keys. These endpoints should be e.g. nested under `/api/projects/:project_id` _or_ should accept `project_id` in request body.

#### *Thank you* for your bug report – we love squashing them!

posthog/api/test/test_decide.py
response = self._post_decide()
        self.assertEqual(response["sessionRecording"], False)
        self.team.session_recording_opt_in = True
        self.team.save()
        response = self._post_decide()
        self.assertEqual(response["sessionRecording"], {"endpoint": "/s"})
    def test_user_session_recording_evil_site(self):
        self.team.app_urls = ["https://example.com"]
        self.team.session_recording_opt_in = True
        self.team.save()
        response = self._post_decide(origin="evil.site.com")
        self.assertEqual(response["sessionRecording"], False)
        response = self._post_decide(origin="https://example.com")
        self.assertEqual(response["sessionRecording"], {"endpoint": "/s"})
    def test_feature_flags(self):
        self.team.app_urls = ["https://example.com"]
        self.team.save()
        self.client.logout()
        Person.objects.create(team=self.team, distinct_ids=["example_id"])
        FeatureFlag.objects.create(
            team=self.team, rollout_percentage=50, name="Beta feature", key="beta-feature", created_by=self.user,
        )
        
        FeatureFlag.objects.create(
            team=self.team,