Todo API without authorization