add CORS and HSTS
update npm dependencies