Use helmet for more secure headers
Create base routes file
Use csp only in production
Add initial views and layouts