first pass at flask app using -security