Fix bug where you could not favorite someone else's list (#49)
While we're at it, fix permissions on list items