use CSRF/SecurityHeaders, update to Jquery 1.11.1, upgrade to latest play/scala