Add security middleware for serving non-html file data

[dbartholomae]

helmet has a list of middlewares to improve server security. It seems only two are relevant when serving non-html file data:

• ieNoOpen
• noSniff