fix(server): Ensure all JSON responses are protected