update todo routes to be admin-auth filtered