[docs] Readme should explain whether helmet is useful on a subroute

Thanks for this great module, and for taking the responsibility to keep up to date with security header news!

I wonder whether I should use helmet in my API server. Any website shall be able to talk to that API server, so I'd probably not want to run helmet server-wide. However, for admin convenience it does have some sub-namespaces for hosting static files. Should I run helmet on those routes? Then again, some headers may be useful even for my server as a whole, like the ones that tell browsers not to misinterpret a random JSON API reply as HTML and run JS in it. It would be nice if you could advise on such situations in readme.