Add Configurable browser policy

[toinevk]

Add Configurable browser policy & update demo to provide example

[PEM--]

Thanks @toinevk

Some remarks before I can merge your contribution:

• This enhancement is targeted for 3.0.0, it should be on the development branch instead of the master one. We are following git flow branching model.
• You should pass down an helmet object instead of a manually configured one. This way, package user are able to directly follow helmet's docs.
• The former behavior was to always have these securities setup. With your PR, package users that haven't configured helmetends up having none, which is bad.

[toinevk]

Thanks @pem-- , hopefully I have addressed your concerns. In terms of your last point, I intentionally left default express call in create router and it will only be overridden if the user choses to pass an helmet object. Hope that makes sense.