stellar/stellar-client — pull request #715 by bartekn (2014-08-27 19:17:30+00:00)
Title: Security improvements

One of gulp tasks was moving a lot of example and debug html files from `bower_components` subdirectories to `dist`. Here's a list of that files:
```
bower_components/
├── angular-password-strength
│ └── example.html
├── modernizr
│ └── test
│ ├── basic.html
│ ├── caniuse_files
│ │ ├── form_validation.html
│ │ ├── hashchange.html
│ │ ├── mathml.html
│ │ ├── pushstate.html
│ │ └── xhtml.html
│ ├── caniuse.html
│ ├── index.html
│ └── js
│ └── basic.html
├── ng-clip
│ └── example
│ ├── bootstrap-tooltip.html
│ ├── index.html
│ └── ng-repeat.html
├── ng-grid
│ └── plugins
│ └── playground.html
└── zeroclipboard
└── dist
└── ZeroClipboard.swf
```
The problem is that all of these files are publicly accessible in a production server ([example](https://launch.stellar.org/bower_components/ng-grid/plugins/playground.html)). I've checked for potential vulnerabilities in these files and couldn't find anything that is harmful in any way but in case more bower components will be added in a future, it's better to fix that, what I did.

I added [`helmet`](https://www.npmjs.org/package/helmet) package to add following headers to `connect` server responses:
* `X-Frame-Options: sameorigin` - to protect from clickjacking.
* `Strict-Transport-Security` - to prevent man-in-the-middle attacks when "Remember me" is used.
* `X-Content-Type-Options: nosniff` - to discourage browsers from "sniffing" mimetypes.

I also added new `Options` setting: `COOKIE_SECURE`. When it's `true`, `localWalletKey` cookie will be set with `Secure` flag (cookie will available only in `https` protocol). It will prevent from MITM attacks in case HSTS `max-age` expires.

PS. Funny thing, I can bet that when I started working on security headers launch.stellar.org wasn't sending any of them and now it does. Did you change it recently? :)