Added authorization

Users now have to be logged in to access todos/new.

Also removed todos#show, since individual todos are visible in the list.
Good work here only exposing the minimal set of routes needed :+1: