http://expressjs.com/en/advanced/best-practice-security.html

Look at that and decide what to do about it when we get to the point where it makes sense.