+ added env constant for api location
+ reverted to older ember/data versions that weren't broken
+ fix additional csp security issues
+ remove deprecated app.router usage