Expose Helmet configuration

- Fixes #962

docs/_docs/00-01-faq.md

@@ -3,6 +3,21 @@ title: Frequently Asked Questions
 permalink: /docs/faq/
 ---
 
+{% include toc %}
+
+### My site doesn't use HSTS headers, how do I stop Talk from sending them too?
+
+You can specify the configuration option `TALK_HELMET_CONFIGURATION` and set it
+to:
+
+```
+TALK_HELMET_CONFIGURATION={"hsts": false}
+```
+
+Which will disable the HSTS module. See the
+[helmet](https://github.com/helmetjs/helmet) repository for more information on
+how to configure other security middleware used by default.
+
 ### How are new stories/assets added to Talk? Is there an API?
 
 There are three ways that new assets can make their way into Talk:

docs/_docs/02-01-configuration.md

@@ -96,6 +96,12 @@ These are only used during the webpack build.
   and you would then specify the CDN/Storage url. (Default `process.env.TALK_ROOT_URL`)
 - `TALK_DISABLE_STATIC_SERVER` (_optional_) - When `TRUE`, it will not mount the
   static asset serving routes on the router. (Default `FALSE`)
+- `TALK_HELMET_CONFIGURATION` (_optional_) - A JSON string representing the
+  configuration passed to the
+  [helmet](https://github.com/helmetjs/helmet) middleware. It can be used to
+  disable features like [HSTS](https://helmetjs.github.io/docs/hsts/) and others
+  by simply providing the configuration as detailed on the
+  [helmet README](https://github.com/helmetjs/helmet). (Default `{}`)
 
 ### Word Filter