Shouldn't here be some sort of user_id checking, so you could only delete stuff from your own todolist?