add cors for CORS headers, add helmet for security, add morgan for logging Signed-off-by: Arthur Lu <learthurgo@gmail.com>