Move hidePoweredBy into its own module

Closes #70.
Lock in helmet-crossdomain version