Secure todo deletions

Regarding your suggestions from pull request https://github.com/jpalmieri/blocitoff/pull/9

>Looks like there's a vulnerability here where a logged-in user could potentially delete another user's todos by trying out different ids in the requested URL.

>To check if this vulnerability exists, and before fixing it if it does:

>Create a new branch (e.g. secure-todo-deletions)
>Write a controller spec that exposes the vulnerability with a failing spec. As this attack isn't really possible >through clicking things in the UI, and so hard-to-test in a feature spec, a controller spec where we can control and tamper with the request params, as an attacker could, is a better place to test for this.
>If the problem exists, then fix it, and ensure the new spec passes

I think I've fixed the vulnerability. Let me know if this looks good to you. Thanks!

Is RSpec complaining about using deprecated `should` syntax? If so switch to the `expect(...)` syntax. Cheatsheet with `expect` usage for controller specs here: https://gist.github.com/eliotsykes/5b71277b0813fbc0df56