have security filter return custom header indicating authentication status
removed unnecessary endpoint methods, fix token handling issue in javascript