Enforce and test TODO_STAFF_ONLY setting

todo/views/delete_task.py

@@ -1,13 +1,16 @@
 from django.contrib import messages
-from django.contrib.auth.decorators import login_required
+from django.contrib.auth.decorators import login_required, user_passes_test
 from django.core.exceptions import PermissionDenied
 from django.http import HttpResponse
 from django.shortcuts import get_object_or_404, redirect
 from django.urls import reverse
 
 from todo.models import Task
+from todo.utils import staff_check
+
 
 @login_required
+@user_passes_test(staff_check)
 def delete_task(request, task_id: int) -> HttpResponse:
     """Delete specified task.
     Redirect to the list from which the task came.