Helmet, httpOnly

Added helmet to enhance the security of the website. It's currently
configured to default 'self' but the style-src has unsafe-inline set to
true. Although this may be a vulnerability, it interferes with jQuery
and some of the other JS libs that edit styles inline. With the other
CSPs set to self, there should be almost no risk of attacks.

The downside to using helmet and CSPs is that inline JS is no longer
allowed. Thus all the inline JS including any onclick calls were pulled
out into a main.js file.

httpOnly was also added to the cookieSession so for browsers that follow
httpOnly, the cookie is only accesible by the server and not by the
client.