Auth token

I haven't had much time to work on this, but this is what I have so far, including the work we did on Wednesday. 

I haven't gotten the `"prevents logged in attacker from deleting others todos"`spec to pass, but I thin this is because I haven't added auth tokens yet.

I'm interested in what you think about the controller logic. It seems like there's probably a better way to do this.
The controller looks good so far. Once the other actions are implemented there'll be some duplicated 
authentication code that can be moved to a `before_action` callback but we're not at that stage yet.

Here's an alternative way of writing the controller, I'd hesitate saying it was any "better" though, just different:

```ruby
def destroy
  user = User.find_by_auth_token(request.headers["Authorization"])

  if user
    user.todos.find(params[:id]).destroy
    head :no_content    
  else
    render json: {message: "Unauthorized"}, status: :unauthorized
  end
end
```

I *might* have gone with an implementation closer to this just because I tend to favor the user-scoped queries like `user.todos.find ...` as I feel I'm less likely to accidentally introduce a security flaw compared with `Todo.find ...`.