CheckList API + tests

GET + POST
sets obj permissions on new CheckList