User access

Users can only see their own todo items when they login. They can not edit/access the todo items that do not belong to them.
same problem as with the scenarios in the other PRs. A scenario would be 'Trying to visit url to edit an item'