express webserver rate limiting and more security measures

.js

const limitter = require('express-rate-limit')
const helmet = require('helmet')

...

// middlewares

app.use(
  limitter({
    windowMs: 5000,
    max: 5,
    message: {
      code: 429, /* Too Many Requests */
      message: "You've made too many requests recently. Please wait and try your request again later."
    }
  })
)

app.use(express.csrf()); // csrf protection
app.use(helmet.xframe())
app.use(helmet.iexss())
app.use(helmet.contentTypeOptions())
app.use(helmet.cacheControl())
app.use((req, res, next) => {
  delete req.headers['x-powered-by'];
  next();
});

...