Upgrade helmet
Add X-Content-Type-Options:nosniff

in case we allow profile image upload in the future
[#75]