Add helmet npm middlewares

Adds x-frame-options (DENY) and Strict Transport Security headers
It'd be good to get a test around the hsts header too.