fixing some security issues and harderning service

app-code/api/login/check_pw.php

@@ -1,5 +1,7 @@
 <?php
-session_start();
+include "../utils/security.php";
+secure_session_start();
+require_same_origin_request();
 header('Content-Type: application/json');
 $send_to=$_SESSION["end_url"];
 
@@ -17,10 +19,11 @@ $pepper="";
 mysqli_stmt_bind_result($stmt, $pw,$pepper);
 mysqli_stmt_fetch($stmt);
 mysqli_stmt_close($stmt);
-$password=$_POST["password"];
+$password=$_POST["password"] ?? "";
 
-if(password_verify($password.$pepper,$pw)){
+if($pw !== "" && password_verify($password.$pepper,$pw)){
 	$_SESSION["pw_authenticated"]=1;
+	session_regenerate_id(true);
 	$data = [
 		'status' => 'success'
 	];