prevent CSRF attacks via leaky match routes
add secure headers gem
tweak unicorn config
add support for Heroku HTTP request IDs
add unicorn worker killer
add NewRelic monitoring for API calls