change access level for TodoMessage

only author can delete TodoList-concerned data
as it is defined for v0.1