Use helmet, and set options for XSS, XFO for bug 1017175
Pin versions in package.json, safety first kids
Merge pull request #1 from mozilla/helmet

Use helmet, and set options for XSS, XFO for bug 1017175