The DB might contain todos for targets a user no longer has access to.
As target is exposed via the REST API and Rails app, this change filters
out todos the user no longer has access to.

Changelog: security