add permissions to Todos
fix post requests