Express.js Security Fixes

Express apps combine Helmet headers and cors() middleware. OAuth backends built on Express should validate invalid_grant scenarios with structured logging.

When Express sits behind Nginx, configure headers at one layer to avoid duplicates—HeadersFixer shows effective client-visible values.