Remove browser sniffing

[EvanHahn]

Remove browser sniffing

[XhmikosR]

I think it's fine to do this in a major version bump. Which browsers still need the old header exactly? On the other hand having it disabled by default, does it slow down things still?

[EvanHahn]

Browsers have varying support for CSP. Some use different headers (like X-WebKit-CSP instead of Content-Security-Policy) where others have different names for directives (like allow instead of default-src). This module currently tries to figure those things out, but I intend to remove them unless people think doing so is a bad idea.

[kara-ryli]

Definitely 👍. We've been running with browser sniffing off since #32 landed -- my biggest concern at that time was the cacheability of browser-sniffed requests.

[XhmikosR]

TBH I too have browser sniffing off for years.

[webuniverseio]

👍 I had to turn off browser sniffing too and reasons for removal make sense.

[EvanHahn]

This has been addressed in helmet@4 and [email protected].

I'm going to be archiving this repository soon and moving everything to https://github.com/helmetjs/helmet/, so feel free to open an issue there if you run into any problems.