Swagger is blocked by CSP
When I visit `http://localhost:3000/swagger-html`, I got below error in the console.

```
Refused to load the script 'https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/3.21.0/swagger-ui-bundle.js' because it violates the following Content Security Policy directive: "script-src 'self'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
```

It turns out that the Content Security Policy enabled by helmet blocks loading swagger related files from CDN, since this issue is gone after comment out `app.use(helmet())`.