fleshing out todos api controller methods