Consider document ownership in ToDo permission hooks

Permission checks now properly account for ToDo ownership, preventing unauthorized access to other users' tasks.