fix whitespace + form action
Bump hapi to avoid 'insecure' dependency badge