Secure Express

tl;dr: 

1. Don't run as root.
1. For sessions, set httpOnly and secure to true when setting cookies. 
1. Use the Helmet for secure headers: https://github.com/evilpacket/helmet
1. Enable `csrf` for preventing Cross-Site Request Forgery: http://expressjs.com/api.html#csrf
1. Don't use the deprecated `bodyParser()` and only use multipart uploads explicitly. To avoid the 'temp file' bloat problem, `pipe()` the multipart upload stream to the destination.