update TODO, remove note about plone.api (too premature to consider at the moment)