put helmet.js on, closes #105
version bumped 0.9.8