@RequestMapping(value = "editList", method = RequestMethod.POST)
    public @ResponseBody
    TodoList editList(@RequestParam Integer id, @RequestParam String title,
                      @RequestParam int pubStatus, WebRequest webRequest) {
        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
        if (authentication.isAuthenticated() && (authentication.getPrincipal() instanceof User)) {
            TodoList list = todoListsDAO.findListById(id);
            if (list == null)
                return null;

            TodoUser todoUser = (TodoUser) webRequest.getAttribute("user", WebRequest.SCOPE_SESSION);
            if (list.getAuthor().getId().intValue() != todoUser.getId().intValue()
                && !"ROLE_ADMIN".equals(todoUser.getRole()))
                return null;
            list.setTitle(title);
            list.setPubStatus(pubStatus);
            todoListsDAO.addList(list);
            return list;
        }
        return null;
    }