Add authentication check to task status

We seem to have removed the authentication check when querying a task's status. We should add a check to make sure the user owns a task before returning the result.

No file or test is named. Start by tracing the task-status query entry point and compare its authorization behavior with other task operations; done means a user cannot receive status for a task they do not own, while authorized task status queries still work.

Written by the indexing model from the issue text.