Scoping todo lists (todo_lists belong to a user)