todos lists belongs to users, allows creator only to see them