refactored to not interact with session in controller and view
added ability to create todos