impr.

use JsonResponse.
use token factory from bridge.
use http request verifier from bridge.
set no-store and etc headers.
doc in html not markdown on root page.