Bit of security hardening

* Add Helmet app dependency.
* Remove crossdomain.xml; we now use Helmet's default served file.
* Ensure that our session cookie's 'httpOnly' member is set to true.
Misc clean up

* about.jade: Add page title.

* contact_form.jade: Add contact_form class onto form element's class
list.

* error.jade: Add support email link.