Add helmet npm dependency
[#74047832] Add web.config

This is a copy of the web.config file currently deployed to Azure.
[#74047832] Disable ARRAffinity cookie

TL;DR: This commit disables the ARRAffinity cookie which Azure sets to
tell application and request routing to ensure a client's connection to a
website always stays on the same IIS instance (as Azure Web Sites are PaaS
with many IIS backends).

Azure proxies requests through application and request routing (ARR) servers
which sit behind the Azure load balancers. These ARR servers are, in
essence, sticky load balancers meaning that each website sticks to the same
IIS instance. Setting the ARRAffinity cookie means that if the cookie exists
then Azure will re-route requests back to the IIS backend originally
responsible for serving the website. Disabling the cookie stops this from
occurring - it's difficult to sort scaling with it enabled, for instance,
but we want it disabled to ensure that this app doesn't set any cookies on
client machines.

Further details at
http://social.msdn.microsoft.com/Forums/windowsazure/de-DE/0ba2c2f6-d5a1-40b6-8d0d-e44b58b65753/will-azure-load-balance-correctly-and-avoid-a-problem-that-app-harbor-had-to-patch-for-me?forum=windowsazurewebsitespreview
and
http://social.msdn.microsoft.com/forums/windowsazure/en-US/0bf53494-d547-4085-b467-efa908a9e751/how-to-get-rid-of-the-arraffinity-cookie-with-websites
Use helmet middlewares

Use the x-frame-options and Strict-Transport-Security middlewares
Force redirect to SSL URL when not in development
Merge pull request #22 from alphagov/add_helmet_middleware

Add helmet npm middlewares
Merge pull request #23 from alphagov/disable-arrafinity

[#74047832] Disable ARR session affinity
Reorder middleware to ensure correct headers are available.

It's imperative that middleware which fixes the omitted Azure SSL
headers is evaluated before any subsequent middleware relying on
accurate detection of the secure protocol.
Merge pull request #25 from alphagov/reorder_middleware_for_ssl_redirects

Reorder middleware to ensure correct headers are available.
Merge branch 'master' into winazure_deployment