Add security headers, configured on or off in .env for bug 1017175

Uses helmet v0.2.1 to optionally use three different security headers setups:

* iexss protection
* XFO headers set to deny
* hsts 

These are configured with env variables as shown in sample.env:

HSTS_ENABLED=
XFO_HEADERS_DENY=
IEXSS_PROTECTION_ENABLED=