protect against csrf
fix ajax post requests to set content type to json
update a few packages
update usage of bodyParser to avoid deprecation warnings
color tweaks