added todo js and tidied up the endpoint with auth