## Bug description

Since users can now be part of multiple projects, the `get_team_from_token` function used in capture and decide endpoints cannot work reliably with personal API keys. These endpoints should be e.g. nested under `/api/projects/:project_id` _or_ should accept `project_id` in request body.

#### *Thank you* for your bug report – we love squashing them!

posthog/api/decide.py
import json
import secrets
from typing import Any, Dict, List, Optional, Tuple, Union
from urllib.parse import urlparse
from django.conf import settings
from django.http import HttpRequest, JsonResponse
from django.views.decorators.csrf import csrf_exempt
from posthog.auth import PersonalAPIKeyAuthentication
from posthog.models import FeatureFlag, Team
from posthog.utils import base64_to_json, cors_response, load_data_from_request
def _get_token(data, request):
    if request.POST.get("api_key"):
        return request.POST["api_key"]
    if request.POST.get("token"):
        return request.POST["token"]
    if "token" in data:
        return data["token"]  
    if "api_key" in data:
        return data["api_key"]  
    return None
def on_permitted_domain(team: Team, request: HttpRequest) -> bool:
    permitted_domains = ["127.0.0.1", "localhost"]
    for url in team.app_urls:
        hostname = parse_domain(url)
        if hostname:
            permitted_domains.append(hostname)
    return (parse_domain(request.headers.get("Origin")) in permitted_domains) or (
        parse_domain(request.headers.get("Referer")) in permitted_domains
    )
def decide_editor_params(request: HttpRequest) -> Tuple[Dict[str, Any], bool]: