Security improvements

One of gulp tasks was moving a lot of example and debug html files from `bower_components` subdirectories to `dist`. Here's a list of these files:
```
bower_components/
├── angular-password-strength
│   └── example.html
├── modernizr
│   └── test
│       ├── basic.html
│       ├── caniuse_files
│       │   ├── form_validation.html
│       │   ├── hashchange.html
│       │   ├── mathml.html
│       │   ├── pushstate.html
│       │   └── xhtml.html
│       ├── caniuse.html
│       ├── index.html
│       └── js
│           └── basic.html
├── ng-clip
│   └── example
│       ├── bootstrap-tooltip.html
│       ├── index.html
│       └── ng-repeat.html
├── ng-grid
│   └── plugins
│       └── playground.html
└── zeroclipboard
    └── dist
        └── ZeroClipboard.swf
```
The problem is that all of these files are publicly accessible in a production server ([example](https://launch.stellar.org/bower_components/ng-grid/plugins/playground.html)). I've checked for potential vulnerabilities in these files and couldn't find anything that is harmful in any way but in case more bower components will be added in a future, it's better to fix that. Also, these files load scripts from other domains that may be hacked what would allow attacks on Stellar.

I added [`helmet`](https://www.npmjs.org/package/helmet) package to add following headers to `connect` server responses:
* `X-Frame-Options: sameorigin` - to protect from clickjacking.
* `Strict-Transport-Security` - to prevent man-in-the-middle attacks when "Remember me" is used.
* `X-Content-Type-Options: nosniff` - to discourage browsers from "sniffing" mimetypes.

I also added new `Options` setting: `COOKIE_SECURE`. When it's `true`, `localWalletKey` cookie will be set with `Secure` flag (cookie will available only in `https` protocol). It will prevent from MITM attacks in case HSTS `max-age` expires.

PS. Funny thing, I can bet that when I started working on security headers launch.stellar.org wasn't sending any of them and now it does. Did you change it recently? :)