Allow server_tokens to be parameterised

As part of a recent ITHC / penetration test, we were advised not
to disclose this information in responses. Easy enough to fix.