Add security headers, configured on or off in .env, provided by helmet module for bug 1017175
Change headers to default to more secure
Add a note about HSTS in the README
Move README info about sec headers, clean up .env file, set HSTS disabled to true for devs
Merge branch 'helmetheaders' of https://github.com/jdotpz/appmaker into jdotpz-helmetheaders

Conflicts:
	app.js