serve our own polyfills instead of relying on external service.
add helmet for basic security measures
add basic csrf support. ensure we test this fully before deploying