Refactor TodosController to use current_user instead of directly interacting with the session hash