Add helmet and security headers optionally configured in .env

Hi Mavis!

This adds some security features to the app, configured within the .env.  

Specifically, it allows us these:
X-FRAME-OPTIONS:DENY
X-Powered-By:Express
X-XSS-Protection:1; mode=block
As well as HSTS (not for us, not without https)

https://bugzilla.mozilla.org/show_bug.cgi?id=1018398 is the bug I'm working on this for.