updates npm in npm-www to latest
adds security headers
removes inline scripts