can create + update todos via json; post route for todos#update; moved strong params into private method