fixed todos to work with mongoose
added requireLogin middleware