testing changes
verify headers
added security middleware
csrf cleanup required
render json