chore(webapp): improve security (trusted_hosts, session)