Add security headers, configured on or off in .env, provided by helmet module for bug 1017175
Change headers to default to more secure
Add a note about HSTS in the README
fix #1265 flathead to appmaker
removed commented code
Move README info about sec headers, clean up .env file, set HSTS disabled to true for devs
The removed chunk of code was throwing js errors on saved apps, and also seems redundant, as updateChannelVis gets fired when it is needed anyway.
Merge branch 'helmetheaders' of https://github.com/jdotpz/appmaker into jdotpz-helmetheaders

Conflicts:
	app.js
Merge branch 'jdotpz-helmetheaders'
Merge branch 't1265' of https://github.com/ScottDowne/appmaker into ScottDowne-t1265
Reverting a couple s/flathead/appmaker/ changes
scrollable app/component lists
Merge pull request #1395 from Pomax/applist

fix #1261 - scrollable app/component lists
Merge pull request #1419 from flukeout/visbugfix

Ceci-element-designer bugfix.
noxmox s3 publishing for local usage
Merge pull request #1399 from ScottDowne/noxmox

noxmox s3 publishing for local usage
Merge pull request #1429 from mozilla-appmaker/master

package version update
fix #1312 Send app name to makeapi and not the crazy random string
Merge pull request #1366 from ScottDowne/t1312

fix #1312 Send app name to makeapi and not the crazy random string
Building JS bundle after merging #1366