No need to nest. Since a user can only see her/his own lists and tasks, you don't have to nest these resources. Define them separately in your routes file and retrieve the current user from your authentication framework.