move helmet and express.static before sessions for performance