update readme.md and fix todo_user authorization