Security and test changes

Added clickjacking protection, force browser XSS filter, JSON hijacking.
Added production-ready server run line.
Made server references in testdata_toapi.py as a variable so they are
easier to change.