more authorization stuff, tasks can't be edited by non-members