changing the password to connect to the database
adding protection to one of the javascript controllers by setting the response type

I have read that if the response type is set to json/application then it
is not vunerable to certain types of attack. Have therefore put it on
one controller and will roll it out to others ASAP