ignore cors for now and fixed user params in controller
got the createTodo action to be called