attempt to check in the changes that don't break authentication + some fixes
moved the userData into the session, under req.session.user, updated views
view task capability, also make sure you can't click done on a task multiple times.