Card #226 remove observation get all endpoint and js service call, lighten security on observationheading, test fixes