need spray-json
note TODOs to comply with SECURITY.md