compiling livescript with const

- manage mutable state with objects: state={is-open:true}
silence webpack warning about primus

- loading in layout.jade instead
wait for all assets to be written before running webpack dev server

- slower, though prevents duplicate initial runs
re-enable security helmet in all environments

- no longer conflicting in development env