## Bug description

Since users can now be part of multiple projects, the `get_team_from_token` function used in capture and decide endpoints cannot work reliably with personal API keys. These endpoints should be e.g. nested under `/api/projects/:project_id` _or_ should accept `project_id` in request body.

#### *Thank you* for your bug report – we love squashing them!

posthog/api/decide.py
if request.COOKIES.get(settings.TOOLBAR_COOKIE_NAME):
        response["isAuthenticated"] = True
        if settings.JS_URL:
            response["editorParams"] = {"jsURL": settings.JS_URL, "toolbarVersion": "toolbar"}
    if request.user.is_authenticated:
        r, update_user_token = decide_editor_params(request)
        response.update(r)
        if update_user_token:
            request.user.temporary_token = secrets.token_urlsafe(32)
            request.user.save()
    response["featureFlags"] = []
    response["sessionRecording"] = False
    if request.method == "POST":
        try:
            data_from_request = load_data_from_request(request)
        except (json.decoder.JSONDecodeError, TypeError):
            return cors_response(
                request,
                JsonResponse(
                    {"code": "validation", "message": "Malformed request data. Make sure you're sending valid JSON.",},
                    status=400,
                ),
            )
        team = get_team_from_token(request, data_from_request)
        if team:
            response["featureFlags"] = feature_flags(request, team, data_from_request["data"])
            if team.session_recording_opt_in and (on_permitted_domain(team, request) or len(team.app_urls) == 0):
                response["sessionRecording"] = {"endpoint": "/s"}
    return cors_response(request, JsonResponse(response))