fixed permission for viewing todos