csp csrf and cookies for app
rm logs, jquery post and twitter
comments and small improvements
dry