Added authorization

Users now have to be logged in to access todos/new.

Also removed todos#show, since individual todos are visible in the list.
Looks like there's a vulnerability here where a logged-in user could potentially delete another user's todos by trying out different ids in the requested URL.

To check if this vulnerability exists, and before fixing it if it does:

- Create a new branch (e.g. `secure-todo-deletions`)
- Write a controller spec that exposes the vulnerability with a failing spec. As this attack isn't really possible through clicking things in the UI, and so hard-to-test in a feature spec, a controller spec where we can control and tamper with the request params, as an attacker could, is a better place to test for this.
- If the problem exists, then fix it, and ensure the new spec passes