Enforce rules for editing tasks/projects

Must be an owner or an admin.  Enforce those rules
using a new `ownerOrAdmin` policy.  Before, it looked
like anyone could change/remove tasks/projects.  Whoops.