update ToDo list on README and fix misspelling in password_resets_controller