basic xss filtering
request is a devDependency
send csp headers

 - make server in `server.js` require-able