The Challenge detail API (added in #133) needs to perform visibility / permission checking on the embedded list of Tasks.