Added authorization

Users now have to be logged in to access todos/new.

Also removed todos#show, since individual todos are visible in the list.