Avoid NPE in REST api deserialisation

- motivated by NPE in TaskSummary<init> for tags