I used `npm run coverage` while *not* excluding the test folder to detect dead code in our test folder, it is actually pretty useful to do so (as a one-shot, not to do that in our config).
Only remaining unreached path is L40 in `test/plugins/auth/ldap.js`, but it does seem to me that it might be useful in case of failures, so I preferred to leave it there.
Several ES6 additions are only available in strict mode. Example:
> SyntaxError: Block-scoped declarations (let, const, function, class) not yet supported outside strict mode
Strict mode was also enabled in a few of our files already, and it is a good thing to have anyway.
