move helmet and express.static before sessions for performance

See issue #318 for details on changes.