Locking down the todos controller