diff --git a/.gitignore b/.gitignore
index 9af0b52..2eba573 100644
--- a/.gitignore
+++ b/.gitignore
@@ -36,4 +36,5 @@ yarn-error.log*
 
 /.vscode/
 start.sh
-dev.sh
\ No newline at end of file
+dev.sh
+ecosystem.config.js
\ No newline at end of file
diff --git a/actions/authActions.js b/actions/authActions.js
index 31f0962..7fe11ab 100644
--- a/actions/authActions.js
+++ b/actions/authActions.js
@@ -32,9 +32,6 @@ export const sendLoginFormEmail = ({ email, password, dispatch }) =>
 		axios.post(`${ process.env.NEXT_PUBLIC_API_HOST }/api/account/auth/email/`, { email, password })
 		.then((response) => 
 		{
-			//console.log("sendLoginFormEmail RESPONSE");
-			//console.log(response.data);
-
 			if(response.data.status === "success")
 			{
 				const cookies = new Cookies();
@@ -48,14 +45,12 @@ export const sendLoginFormEmail = ({ email, password, dispatch }) =>
 					dispatch({ type: actionTypes.COMPANIES, data: { list: response.data.companies } });
 
 					resolve();
-					//Router.push('/');
 					window.location = "/";
 				})
 				.catch(() => 
 				{
 					reject();
 				});
-				//dispatch({ type: actionTypes.COMPANY, data: response.data.company });
 			}
 			else
 			{
@@ -64,8 +59,6 @@ export const sendLoginFormEmail = ({ email, password, dispatch }) =>
 		})
 		.catch((error) => 
 		{
-			//console.log("error");
-
 			console.error(error);
 
 			reject();
@@ -80,21 +73,12 @@ export const sendLoginFormPhone = ({ phone }) =>
 		axios.post(`${ process.env.NEXT_PUBLIC_SELF_API_HOST }/api/auth/phone/check`, { phone })
 		.then((response) => 
 		{
-			//console.log("sendLoginFormPhone RESPONSE");
-
-			//console.log(response.data);
-
-
 			if(response.data)
 			{
-				//console.log("DATA? ");
-
 				resolve();
 			}
 			else
 			{
-				//console.log("DATA ! ");
-
 				reject();
 			}
 		})
@@ -115,9 +99,6 @@ export const sendSmsCode = ({ dispatch, phone, code }) =>
 		axios.post(`${ process.env.NEXT_PUBLIC_SELF_API_HOST }/api/auth/phone/code`, { phone, code })
 		.then((response) => 
 		{
-			//console.log("sendSmsCode RESPONSE");
-			//console.log(response.data);
-
 			if(response.data.status === "success")
 			{
 				const cookies = new Cookies();
@@ -130,7 +111,6 @@ export const sendSmsCode = ({ dispatch, phone, code }) =>
 					dispatch({ type: actionTypes.USER, data: response.data.user });	
 
 					resolve();
-					//Router.push('/');
 					window.location = "/";
 				})
 				.catch(() => 
@@ -177,7 +157,6 @@ export const logout = ({ dispatch, redirect = true }) =>
 		resolve();
 		if(redirect)
 		{
-			//Router.push('/');
 			window.location = "/";
 		}
 	});
@@ -185,19 +164,11 @@ export const logout = ({ dispatch, redirect = true }) =>
 
 export const sendOffstageToken = ({ token, dispatch }) => 
 {
-	//console.log("ACTION", "sendOffstageToken()", `${ process.env.NEXT_PUBLIC_SELF_API_HOST }/api/auth/offstage/`);
-
-
 	return new Promise((resolve, reject) => 
 	{
 		axios.post(`${ process.env.NEXT_PUBLIC_SELF_API_HOST }/api/auth/offstage/`, { token })
 		.then((response) => 
 		{
-			//console.log("sendOffstageToken RESPONSE");
-
-			//console.log(response.data);
-
-
 			if(response.data.status === "success")
 			{
 				const cookies = new Cookies();
diff --git a/lib/CRMRequest/index.js b/lib/CRMRequest/index.js
index 7e9e58f..64413bb 100644
--- a/lib/CRMRequest/index.js
+++ b/lib/CRMRequest/index.js
@@ -82,7 +82,7 @@ export default async function CRMRequest(req, res, path, method, data, log = fal
 		}
 		else
 		{
-			res.status(403);
+			res.status(403).send();
 		}
 	}
 }
\ No newline at end of file
diff --git a/lib/CRMRequestGet/index.js b/lib/CRMRequestGet/index.js
index 669593a..44c3689 100644
--- a/lib/CRMRequestGet/index.js
+++ b/lib/CRMRequestGet/index.js
@@ -101,7 +101,7 @@ export default async function CRMRequestGet({ req, res, path, params, data = und
 		}
 		else
 		{
-			res.status(403);
+			res.status(403).send();
 		}
 	}
 }
\ No newline at end of file
diff --git a/lib/CRMRequestPost/index.js b/lib/CRMRequestPost/index.js
index 32de4c1..e183237 100644
--- a/lib/CRMRequestPost/index.js
+++ b/lib/CRMRequestPost/index.js
@@ -86,7 +86,7 @@ export default async function CRMRequestPost({ req, res, path, params, headers =
 		}
 		else
 		{
-			res.status(403);
+			res.status(403).send();
 		}
 	}
 }
\ No newline at end of file
diff --git a/lib/SmsCenter/index.js b/lib/SmsCenter/index.js
index 73308e5..c49b976 100644
--- a/lib/SmsCenter/index.js
+++ b/lib/SmsCenter/index.js
@@ -7,9 +7,6 @@ class SmsCenter
 {
 	static send(phoneNumber, code)
 	{
-		//console.log("SmsCenter", "propagateUser");
-
-
 		return new Promise((resolve, reject) => 
 		{
 			const packet = qs.stringify({ 
@@ -22,16 +19,11 @@ class SmsCenter
 				fmt: 3, 
 			});
 
-			//console.log(packet);
-
-
 			axios.post(SMS_API_HOST, packet, {
 				"Content-Type": "application/x-www-form-urlencoded"
 			})
 			.then((smsSendResponse) => 
 			{
-				//console.log(smsSendResponse.data);
-
 				resolve();
 			})
 			.catch((smsSendError) => 
diff --git a/lib/cors.js b/lib/cors.js
index 91f5a25..a5ca159 100644
--- a/lib/cors.js
+++ b/lib/cors.js
@@ -2,9 +2,6 @@ import Cors from 'cors';
 
 function initMiddleware(middleware) 
 {
-	//console.log("CORS initMiddleware !!!!");
-
-
 	return (req, res) => 
 		new Promise((resolve, reject) => 
 		{
@@ -20,12 +17,9 @@ function initMiddleware(middleware)
 		});
 }
 
-// Initialize the cors middleware
 const cors = initMiddleware(
-  // You can read more about the available options here: https://github.com/expressjs/cors#configuration-options
 	Cors({
-		origin: ["https://localhost:3000", "http://localhost:3000", "localhost", "localhost:3000", "http://localhost", "https://lk-evo.quickcode.ru"], 
-		// Only allow requests with GET, POST and OPTIONS
+		origin: JSON.parse(process.env.ORIGINS), 
 		methods: ['GET', 'POST', 'OPTIONS'],
 	})
 )
diff --git a/next.config.js b/next.config.js
index 85a3f25..567b5de 100644
--- a/next.config.js
+++ b/next.config.js
@@ -3,31 +3,13 @@ const withFonts = require('next-fonts');
 const withLess = require("next-with-less");
 const { withSentryConfig } = require("@sentry/nextjs");
 
+console.log({ "ORIGINS": JSON.parse(process.env.ORIGINS) });
+
 module.exports = withSentryConfig(withImages(withFonts(withLess({
 	images: {
-		domains: [ 'lk-evo.quickcode.ru', 'wow.evoleasing.ru', 'www.evoleasing.ru', 'lk.evoleasing.ru', 'evoleasing.ru', 'localhost', 'localhost:3000'],
+		domains: JSON.parse(process.env.ORIGINS),
 	},
 	reactStrictMode: false,
-	/*
-	async headers() 
-	{
-		return [
-			{
-				source: '/api/:path*',
-				headers: [
-					{
-						key: 'Access-Control-Allow-Origin',
-						value: '*',
-					},
-					{
-						key: 'Access-Control-Allow-Methods',
-						value: 'POST, GET, OPTIONS',
-					}
-				],
-			},
-		]
-	},
-	*/
 	async redirects() 
 	{
 		return [ 
@@ -37,11 +19,6 @@ module.exports = withSentryConfig(withImages(withFonts(withLess({
 				destination: '/support/faq', 
 				permanent: false,
 			}, 
-			//{ 
-				//source: '/special', 
-				//destination: '/special/with_producer', 
-				//permanent: true,
-			//}, 
 		]
 	},
 	async rewrites() 
@@ -88,16 +65,10 @@ module.exports = withSentryConfig(withImages(withFonts(withLess({
 					source: "/support/faq", 
 					destination: "/support", 
 				}, 
-				//{ 
-					//source: "/about/reviews/:page(\\d{1,})", 
-					//destination: "/about/reviews", 
-				//}, 
 			],
 		}
 	}, 
 	sentry: {
 		hideSourceMaps: true, 
-		//tunnelRoute: "/errors", 
-		//	silent: true, 
 	},
 }))));
\ No newline at end of file
diff --git a/pages/api/auth/phone/check.js b/pages/api/auth/phone/check.js
index b3b2c50..461e524 100644
--- a/pages/api/auth/phone/check.js
+++ b/pages/api/auth/phone/check.js
@@ -17,57 +17,72 @@ export default async function handler(req, res)
 	let { phone } = req.body;
 	phone = phone.replace(/[^0-9.]/g, '');
 
-	const response = await new Promise((resolve, reject) => 
+	const key = md5(`sms_code_${ phone }`);
+	const key_block = md5(`phone_change_sms_block_${ phone }`);
+
+	const existed_phone = await RedisClient.get(key_block);
+
+	if(existed_phone === null)
 	{
-		console.log("POST", `${ process.env.NEXT_PUBLIC_API_HOST }/api/account/auth/phone/`);
-		axios.post(`${ process.env.NEXT_PUBLIC_API_HOST }/api/account/auth/phone/`, {
-			phone: phone, 
-		})
-		.then((api_response) => 
+		const response = await new Promise((resolve, reject) => 
 		{
-			console.log("RESPONSE");
-			console.log(api_response.data);
+			console.log("POST", `${ process.env.NEXT_PUBLIC_API_HOST }/api/account/auth/phone/`);
+			axios.post(`${ process.env.NEXT_PUBLIC_API_HOST }/api/account/auth/phone/`, {
+				phone: phone, 
+			})
+			.then((api_response) => 
+			{
+				console.log("RESPONSE");
+				console.log(api_response.data);
 
-			resolve(api_response.data);
-		})
-		.catch((error) => 
-		{
-			console.log("error");
-			console.error(error);
+				resolve(api_response.data);
+			})
+			.catch((error) => 
+			{
+				console.log("error");
+				console.error(error);
 
-			reject();
-		});
-	});
-
-	console.log("CHECK response");
-	console.log(response);
-	console.log("-".repeat(50));
-
-	if(response.status === "success")
-	{
-		let code = ``;
-		for(let i = 0; i < 6; i++) { code = `${code}${Math.floor(Math.random()*10)}`; }
-
-		response.code = code;
-
-		const key = md5(`sms_code_${ phone }`);
-		await RedisClient.set(key, JSON.stringify(response), 'EX', 300);
-
-		const smsResult = await SmsCenter.send(phone, code)
-		.then(() => 
-		{
-			res.status(200).json({
-				status: "success", 
+				reject();
 			});
-		})
-		.catch((error) => 
+		});
+
+		console.log("CHECK response");
+		console.log(response);
+		console.log("-".repeat(50));
+
+		if(response.status === "success")
+		{
+			await RedisClient.set(key_block, key_block, 'EX', 60);
+
+			let code = ``;
+			for(let i = 0; i < 6; i++) { code = `${ code }${ Math.floor(Math.random() * 10) }`; }
+
+			response.code = code;
+
+			await RedisClient.set(key, JSON.stringify(response), 'EX', 300);
+
+			await SmsCenter.send(phone, code)
+			.then(() => 
+			{
+				res.status(200).json({
+					status: "success", 
+				});
+			})
+			.catch((error) => 
+			{
+				console.error("SmsCenter.send", "catch");
+				res.status(404).json();
+			});
+		}
+		else
 		{
-			console.error("SmsCenter.send", "catch");
 			res.status(404).json();
-		});	
+		}
 	}
 	else
 	{
-		res.status(404).json();
+		res.status(200).json({
+			status: "await", 
+		});
 	}
 }
\ No newline at end of file
diff --git a/pages/api/calendar.js b/pages/api/calendar.js
index 5315cf8..eb302de 100644
--- a/pages/api/calendar.js
+++ b/pages/api/calendar.js
@@ -34,18 +34,18 @@ export default async function handler(req, res)
 				.catch((error) => 
 				{
 					console.error(error);
-					res.status(500);
+					res.status(500).send();
 				});
 			}
 			catch(e)
 			{
 				console.error(e);
-				res.status(500);
+				res.status(500).send();
 			}
 		}
 		else
 		{
-			res.status(403);
+			res.status(403).send();
 		}
 	}
 }
\ No newline at end of file
diff --git a/pages/api/change/phone/send.js b/pages/api/change/phone/send.js
index cb1ddbd..18ddeba 100644
--- a/pages/api/change/phone/send.js
+++ b/pages/api/change/phone/send.js
@@ -18,24 +18,39 @@ export default async function handler(req, res)
 	let { email, phone } = req.body;
 	phone = phone.replace(/[^0-9.]/g, '');
 
-	let code = ``;
-	for(let i = 0; i < 6; i++) { code = `${code}${Math.floor(Math.random()*10)}`; }
-
 	const key = md5(`phone_change_sms_code_${ phone }`);
-	await RedisClient.set(key, JSON.stringify({
-		email, phone, code
-	}), 'EX', 300);
+	const key_block = md5(`phone_change_sms_block_${ phone }`);
 
-	const smsResult = await SmsCenter.send(phone, code)
-	.then(() => 
+	const existed_phone = await RedisClient.get(key_block);
+
+	if(existed_phone === null)
+	{
+		await RedisClient.set(key_block, key_block, 'EX', 60);
+
+		let code = ``;
+		for(let i = 0; i < 6; i++) { code = `${ code }${ Math.floor(Math.random() * 10) }`; }
+
+		await RedisClient.set(key, JSON.stringify({
+			email, phone, code
+		}), 'EX', 300);
+
+		await SmsCenter.send(phone, code)
+		.then(() => 
+		{
+			res.status(200).json({
+				status: "success", 
+			});
+		})
+		.catch((error) => 
+		{
+			console.error("SmsCenter.send", "catch");
+			res.status(404).json();
+		});
+	}
+	else
 	{
 		res.status(200).json({
-			status: "success", 
+			status: "await", 
 		});
-	})
-	.catch((error) => 
-	{
-		console.error("SmsCenter.send", "catch");
-		res.status(404).json();
-	});
+	}
 }
\ No newline at end of file
diff --git a/pages/api/contracts.js b/pages/api/contracts.js
index 6c28f2f..ed24b05 100644
--- a/pages/api/contracts.js
+++ b/pages/api/contracts.js
@@ -51,18 +51,18 @@ export default async function handler(req, res)
 				.catch((error) => 
 				{
 					console.error(error);
-					res.status(500);
+					res.status(500).send();
 				});
 			}
 			catch(e)
 			{
 				console.error(e);
-				res.status(500);
+				res.status(500).send();
 			}
 		}
 		else
 		{
-			res.status(403);
+			res.status(403).send();
 		}
 	}
 }
\ No newline at end of file
diff --git a/pages/api/file/bitrix.js b/pages/api/file/bitrix.js
index 1442ea5..670da06 100644
--- a/pages/api/file/bitrix.js
+++ b/pages/api/file/bitrix.js
@@ -20,30 +20,43 @@ export default async function handler(req, res)
 				try
 				{
 					console.log("API", "file", "bitrix", "url", req.query.url);
+
 					const url = req.query.url;
-					axios.get(url, {
-						responseType: 'arraybuffer',
-					})
-					.then((bitrix_response) => 
+
+					const url_parser = new URL(url);
+					const origins = JSON.parse(process.env.ORIGINS);
+
+					if(origins.indexOf(url_parser.host) > -1)
 					{
-						res.status(200).send(bitrix_response.data);
-					})
-					.catch((error) => 
+						axios.get(url, {
+							responseType: 'arraybuffer',
+						})
+						.then((bitrix_response) => 
+						{
+							res.status(200).send(bitrix_response.data);
+						})
+						.catch((error) => 
+						{
+							console.error(error);
+							res.status(500).send();
+						});
+					}
+					else
 					{
-						console.error(error);
-						res.status(500);
-					});
+						console.error("API", "file", "bitrix", "url", "wrong URL for file downloading", url);
+						res.status(403).send();
+					}
 				}
 				catch(e)
 				{
 					console.error(e);
-					res.status(500);
+					res.status(403).send();
 				}
 			}
 		}
 		else
 		{
-			res.status(403);
+			res.status(403).send();
 		}
 	}
 }
\ No newline at end of file
diff --git a/pages/api/file/contract/debt.js b/pages/api/file/contract/debt.js
index ab86155..61b2114 100644
--- a/pages/api/file/contract/debt.js
+++ b/pages/api/file/contract/debt.js
@@ -36,18 +36,18 @@ export default async function handler(req, res)
 				.catch((error) => 
 				{
 					console.error(error);
-					res.status(500);
+					res.status(500).send();
 				});
 			}
 			catch(e)
 			{
 				console.error(e);
-				res.status(500);
+				res.status(500).send();
 			}
 		}
 		else
 		{
-			res.status(403);
+			res.status(403).send();
 		}
 	}
 }
\ No newline at end of file
diff --git a/pages/api/file/contract/graphic.js b/pages/api/file/contract/graphic.js
index 5cca5f7..7b70281 100644
--- a/pages/api/file/contract/graphic.js
+++ b/pages/api/file/contract/graphic.js
@@ -40,18 +40,18 @@ export default async function handler(req, res)
 				.catch((error) => 
 				{
 					console.error(error);
-					res.status(500);
+					res.status(500).send();
 				});
 			}
 			catch(e)
 			{
 				console.error(e);
-				res.status(500);
+				res.status(500).send();
 			}
 		}
 		else
 		{
-			res.status(403);
+			res.status(403).send();
 		}
 	}
 }
\ No newline at end of file
diff --git a/pages/api/file/contract/penalty.js b/pages/api/file/contract/penalty.js
index f7fbc01..988cbd7 100644
--- a/pages/api/file/contract/penalty.js
+++ b/pages/api/file/contract/penalty.js
@@ -36,18 +36,18 @@ export default async function handler(req, res)
 				.catch((error) => 
 				{
 					console.error(error);
-					res.status(500);
+					res.status(500).send();
 				});
 			}
 			catch(e)
 			{
 				console.error(e);
-				res.status(500);
+				res.status(500).send();
 			}
 		}
 		else
 		{
-			res.status(403);
+			res.status(403).send();
 		}
 	}
 }
\ No newline at end of file
diff --git a/pages/api/file/fine-after-accrual.js b/pages/api/file/fine-after-accrual.js
index 93e71d0..e68ddca 100644
--- a/pages/api/file/fine-after-accrual.js
+++ b/pages/api/file/fine-after-accrual.js
@@ -34,18 +34,18 @@ export default async function handler(req, res)
 				.catch((error) => 
 				{
 					console.error(error);
-					res.status(500);
+					res.status(500).send();
 				});
 			}
 			catch(e)
 			{
 				console.error(e);
-				res.status(500);
+				res.status(500).send();
 			}
 		}
 		else
 		{
-			res.status(403);
+			res.status(403).send();
 		}
 	}
 }
\ No newline at end of file
diff --git a/pages/api/file/fine-before-accrual.js b/pages/api/file/fine-before-accrual.js
index 6784e0d..cb50450 100644
--- a/pages/api/file/fine-before-accrual.js
+++ b/pages/api/file/fine-before-accrual.js
@@ -34,18 +34,18 @@ export default async function handler(req, res)
 				.catch((error) => 
 				{
 					console.error(error);
-					res.status(500);
+					res.status(500).send();
 				});
 			}
 			catch(e)
 			{
 				console.error(e);
-				res.status(500);
+				res.status(500).send();
 			}
 		}
 		else
 		{
-			res.status(403);
+			res.status(403).send();
 		}
 	}
 }
\ No newline at end of file
diff --git a/pages/api/file/image.js b/pages/api/file/image.js
index 6c8e9df..b62d785 100644
--- a/pages/api/file/image.js
+++ b/pages/api/file/image.js
@@ -36,22 +36,22 @@ export default async function handler(req, res)
 				catch(e)
 				{
 					//console.error(e);
-					res.status(500);
+					res.status(500).send();
 				}	
 			})
 			.catch((error) => 
 			{
 				//console.error(error);
-				res.status(500);
+				res.status(500).send();
 			});
 		}
 		else
 		{
-			res.status(403);
+			res.status(403).send();
 		}
 	}
 	else
 	{
-		res.status(403);
+		res.status(403).send();
 	}
 }
\ No newline at end of file
diff --git a/pages/api/navigation/programs.js b/pages/api/navigation/programs.js
index de31255..c3f1ff2 100644
--- a/pages/api/navigation/programs.js
+++ b/pages/api/navigation/programs.js
@@ -10,5 +10,5 @@ export default async function handler(req, res)
 {
 	//await cors(req, res);
 
-	res.status(200);
+	res.status(200).send();
 }
\ No newline at end of file
diff --git a/pages/api/questionnaire/get.js b/pages/api/questionnaire/get.js
index 360cf3f..9326df9 100644
--- a/pages/api/questionnaire/get.js
+++ b/pages/api/questionnaire/get.js
@@ -113,13 +113,13 @@ export default async function handler(req, res)
 			}
 			else
 			{
-				res.status(403);
+				res.status(403).send();
 				resolve();
 			}
 		}
 		else
 		{
-			res.status(403);
+			res.status(403).send();
 			resolve();
 		}
 	});
diff --git a/pages/api/questionnaire/read.js b/pages/api/questionnaire/read.js
index 447df0e..efbe429 100644
--- a/pages/api/questionnaire/read.js
+++ b/pages/api/questionnaire/read.js
@@ -54,7 +54,7 @@ export default async function handler(req, res)
 		}
 		else
 		{
-			res.status(403);
+			res.status(403).send();
 		}
 	}
 }
\ No newline at end of file
diff --git a/pages/api/support/request.js b/pages/api/support/request.js
index 1e829a5..e820e2c 100644
--- a/pages/api/support/request.js
+++ b/pages/api/support/request.js
@@ -63,7 +63,7 @@ export default async function handler(req, res)
 		}
 		else
 		{
-			res.status(403);
+			res.status(403).send();
 		}
 	}
 }
\ No newline at end of file