Use helmet middlewares

Use the x-frame-options and Strict-Transport-Security middlewares
Force redirect to SSL URL when not in development