In function post():
todo.author = users.get_current_user()
So, to get str(todo.author), you need str(users.get_current_user()). What is returned by get_current_user() function ?
If it is an object, check does it contain a str()" function?
I think the error lies there.