further normalized models by putting task in its own collection.  No more AuthService - instead have UserFactory which maintains user and user's lists