added sinon for spying/stubbing during unit tests
updated security_test.js
added check for req.headers ... for unit testing with empty object