updated with security headers, new routes