add proper authorization for User routes
update ToDo
add links back to Sign In page from Forgot Password pages