Add helmet npm dependency
[#74047832] Add web.config

This is a copy of the web.config file currently deployed to Azure.
[#74047832] Disable ARRAffinity cookie

TL;DR: This commit disables the ARRAffinity cookie which Azure sets to
tell application and request routing to ensure a client's connection to a
website always stays on the same IIS instance (as Azure Web Sites are PaaS
with many IIS backends).

Azure proxies requests through application and request routing (ARR) servers
which sit behind the Azure load balancers. These ARR servers are, in
essence, sticky load balancers meaning that each website sticks to the same
IIS instance. Setting the ARRAffinity cookie means that if the cookie exists
then Azure will re-route requests back to the IIS backend originally
responsible for serving the website. Disabling the cookie stops this from
occurring - it's difficult to sort scaling with it enabled, for instance,
but we want it disabled to ensure that this app doesn't set any cookies on
client machines.

Further details at
http://social.msdn.microsoft.com/Forums/windowsazure/de-DE/0ba2c2f6-d5a1-40b6-8d0d-e44b58b65753/will-azure-load-balance-correctly-and-avoid-a-problem-that-app-harbor-had-to-patch-for-me?forum=windowsazurewebsitespreview
and
http://social.msdn.microsoft.com/forums/windowsazure/en-US/0bf53494-d547-4085-b467-efa908a9e751/how-to-get-rid-of-the-arraffinity-cookie-with-websites
Use helmet middlewares

Use the x-frame-options and Strict-Transport-Security middlewares
Force redirect to SSL URL when not in development
Merge pull request #22 from alphagov/add_helmet_middleware

Add helmet npm middlewares
Merge pull request #23 from alphagov/disable-arrafinity

[#74047832] Disable ARR session affinity
Merge branch 'master' into winazure_preview_deployment