gating all task-related APIs behind the authHandler, and redirecting the TodoCtrl to /auth in case any HTTP call returns 401 Unauthorized