Add helmet and other security-headers

package.json

@@ -21,6 +21,8 @@
     "express": "^4.17.1",
     "express-session": "^1.17.0",
     "extract-text-webpack-plugin": "^3.0.2",
+    "feature-policy": "^0.4.0",
+    "helmet": "^3.21.2",
     "moment": "^2.24.0",
     "mongoose": "^5.8.7",
     "node-fetch": "^2.6.0",
@@ -29,6 +31,7 @@
     "passport-local": "^1.0.0",
     "passport-local-mongoose": "^6.0.1",
     "qrcode": "^1.4.4",
+    "referrer-policy": "^1.2.0",
     "vue": "~2.6",
     "vue-analytics": "^5.22.1",
     "vue-router": "~3.0",