Listen on localhost for HTTP and all interfaces for HTTPS

app.js

@@ -14,6 +14,7 @@ const cookieParser = require('cookie-parser');
 const bodyParser = require('body-parser');
 const expressValidator = require('express-validator');
 const session = require('express-session');
+const helmet = require('helmet');
 
 const index = require('./routes/index');
 const users = require('./routes/users');
@@ -27,7 +28,7 @@ const session_secret = Math.random().toString(36).substring(2,12);
 app.set('views', path.join(__dirname, 'views'));
 app.set('view engine', 'pug');
 
-// uncomment after placing your favicon in /public
+app.use(helmet());
 app.use(favicon(path.join(__dirname, 'public', 'favicon.ico')));
 app.use(logger('dev'));
 app.use(bodyParser.json());