added token_salt and allow_x_headers to the config example in app
updated submodule references