Security fixes (#8081)

* use safeloader

* use json responses wherever possible

* remove CORS and add CSRF token

* formatting fixes

* add envjs back

* fix baseurl test

web/src/api/__tests__/index.test.jsx

@@ -18,6 +18,6 @@ describe('useApiHost', () => {
         <Test />
       </ApiProvider>
     );
-    expect(screen.queryByText('http://base-url.local:5000/')).toBeInTheDocument();
+    expect(screen.queryByText('http://localhost:3000/')).toBeInTheDocument();
   });
 });