refactor and make sure todos are accessed by current user