Security hardening

Rate limiting, security headers, structured logging, and a data exposure fix.