Commit #7 Final step in application security. We removed autopublish to allow us to scope what data is being sent to the client. Then we restricted the ToDo lists that are avaialble to the corresponding user