secured todo endpoints; updated tests accordingly