v1.6.0

- using [helmet](https://github.com/helmetjs/helmet) to set some security headers in the responses (```X-Frame``` and ```X-Content-Type-Options```)
- enabled logging of SQL statements (watching the server log _at all_ while hacking is considered cheating!)