## Bug description

Since users can now be part of multiple projects, the `get_team_from_token` function used in capture and decide endpoints cannot work reliably with personal API keys. These endpoints should be e.g. nested under `/api/projects/:project_id` _or_ should accept `project_id` in request body.

#### *Thank you* for your bug report – we love squashing them!

posthog/api/test/test_decide.py
user = self.organization.members.first()
        user.toolbar_mode = "disabled"
        user.save()
        self.team.app_urls = ["https://example.com/maybesubdomain"]
        self.team.save()
        
        response = self.client.get("/decide", HTTP_ORIGIN="https://example.com").json()
        self.assertEqual(response["isAuthenticated"], True)
        self.assertIsNone(response.get("toolbarVersion", None))
    def test_user_on_evil_site(self):
        user = self.organization.members.first()
        user.toolbar_mode = "toolbar"
        user.save()
        self.team.app_urls = ["https://example.com"]
        self.team.save()
        response = self.client.get("/decide/", HTTP_ORIGIN="https://evilsite.com").json()
        self.assertEqual(response["isAuthenticated"], False)
        self.assertIsNone(response["editorParams"].get("toolbarVersion", None))
    def test_user_on_local_host(self):
        user = self.organization.members.first()
        user.toolbar_mode = "toolbar"
        user.save()
        self.team.app_urls = ["https://example.com"]
        self.team.save()
        response = self.client.get("/decide", HTTP_ORIGIN="http://127.0.0.1:8000").json()
        self.assertEqual(response["isAuthenticated"], True)
        self.assertEqual(response["sessionRecording"], False)
        self.assertEqual(response["editorParams"]["toolbarVersion"], "toolbar")
    def test_user_session_recording_opt_in(self):