Further relax restrictions on cross origin request
Add a list of todo ids to the user resource
Support passing api_token as param or header
Add a show action to the todo controller.
Update documentation.