updated with basic security - CSRF, input validation, hiding server/version headers, etc