updated TODOs and added firebase rules