Helmet expects an Express request object but koa-helmet passes it a Node request
This is specifically a problem when Helmet is looking for fields on the request that a Node request doesn't have, like `request.secure`.

You can see this with the `hsts()` middleware which doesn't send the `Strict-Transport-Security` header since `ctx.req.secure` is always undefined. Passing in `ctx.request` fixes this specific issue, but there might not be a robust solution at hand since Koa request objects aren't guaranteed to be the same as Express request objects.

For the `hsts()` middleware, an easy workaround is to configure the middleware with `{ force: ctx.request.secure }` but it's a little fragile that Helmet's logic for whether to send the HSTS response header needs to be replicated.
