let nginx take care of the security headers, remove helmet.