Refactor to not refer to session from controller and view
Create a todo
Minor refactoring for specs and ensure todos are accessed from current_user