Auth token

I haven't had much time to work on this, but this is what I have so far, including the work we did on Wednesday. 

I haven't gotten the `"prevents logged in attacker from deleting others todos"`spec to pass, but I thin this is because I haven't added auth tokens yet.

I'm interested in what you think about the controller logic. It seems like there's probably a better way to do this.