Improve security by default

[maxkoryukov]

• https://www.npmjs.com/package/csurf
• test all local auth speed (must be slow) - see data package
• use this practices: http://expressjs.com/en/advanced/best-practice-security.html