Hide X-Powered-By header

Express (and possibly other Connect-based libraries) will, by default, send an HTTP header called `X-Powered-By`. If exploits in Express are found, this information could be used by an attacker.

Perhaps worth a version bump and/or an inclusion in `helmet.defaults`.