General fixups to npm settings, added sanitization, csrf, extra checks here and there

Signed-off-by: Ilya Shindyapin <ilya@shindyapin.com>