task create action, changed routes to use resources instead of matching route, unauthorize view if trying to access someone else's show page