+ helmet

package.json

@@ -18,6 +18,7 @@
     "koa": "^0.18.0",
     "koa-conditional-get": "^1.0.2",
     "koa-etag": "^2.0.0",
+    "koa-helmet": "0.0.3",
     "koa-logger": "^1.2.2",
     "koa-prerender": "^1.0.3",
     "koa-route": "^2.4.0",

server.js

@@ -7,6 +7,7 @@ var logger = require("koa-logger");
 var conditional = require("koa-conditional-get");
 var etag = require("koa-etag");
 var prerender = require("koa-prerender");
+var helmet = require('koa-helmet');
 
 var config = require("./config");
 var routes = require("./routes");
@@ -22,6 +23,8 @@ app.use(prerender(config.prerender));
 app.use(serve(path.join(__dirname, "public")));
 app.use(serve(path.join(__dirname, "templates")));
 
+app.use(helmet.defaults());
+
 app.use(function *(next) {
 	var q = this.query;
 	this.query = Object.keys(q)