add security headers, csrf token, and sanitize blog title, content in server