Application: only set csrf cookie if necessary; prevent JSONP attacks in display_response

display 404 upon null controller again
respond naively to OPTIONS requests
define getallheaders() if necessary
Application::requestHeaders, populate application/json POSTs
Angular rewrite: index, api, login