Security fixes (#8081)

* use safeloader

* use json responses wherever possible

* remove CORS and add CSRF token

* formatting fixes

* add envjs back

* fix baseurl test

web/src/__mocks__/env.js

@@ -1,2 +1 @@
 export const ENV = 'test';
-export const API_HOST = 'http://base-url.local:5000/';