Drop support for Node <4

Node 0.10 was EOL'd (end-of-lifed) on 2016-10-31 and Node 0.12 was EOL'd
on 2016-12-31.

This is arguably a backwards-incompatible change, but I think it's safe
because:

1. No affected Node versions are supported. Node 0.10 support ended on
   2016-10-31; Node 0.12 support ended on 2016-12-31. (Node 4 is not
   supported either but that deprecation was less than a year ago, on
   2018-04-01.)
2. If you're using an old Node version, you'll get a warning but you'll
   still be able to install things.
3. ...unless you've set the `engine-strict` configuration value (which
   is unset by default). If you've enabled this obscure setting on an
   old Node version, you will be unable to install new Helmet versions.
   I don't expect to receive a single report about this, but it is the
   one part of this change that is technically breaking.

CHANGELOG.md

@@ -3,6 +3,7 @@
 ## Unreleased
 ### Changed
 - Changelog is now in the [Keep A Changelog](https://keepachangelog.com/) format
+- Dropped support for Node <4
 
 ### Deprecated
 - `helmet.hsts`'s `setIf` option has been deprecated and will be removed in `hsts@3`. See [helmetjs/hsts#22](https://github.com/helmetjs/hsts/issues/22) for more

package.json

@@ -27,7 +27,7 @@
     "url": "git://github.com/helmetjs/helmet.git"
   },
   "engines": {
-    "node": ">= 0.10.0"
+    "node": ">=4.0.0"
   },
   "dependencies": {
     "depd": "2.0.0",