Change the way CORS options request is handled
Create the token based auth api concern
Scope the todos api to the current user