Implement security headers with helmet

[anestv]

Fixes #161

As long as there is a <style>...</style> in the page, the content security policy has to include styleSrc: 'unsafe-inline'

[JulianNorton]

Thank you @anestv ! Will merge now and push into production