Fix session based Todos & authorization