Flask Security Fixes

Flask APIs use Flask-Cors with blueprint-scoped rules. Combine with TLS and HSTS at the proxy—HeadersFixer audits the public URL.