adds STS header

- also some re-ordering of middlewares, based on what should happen
first

fixes #38
Re-order a few lines in server.js, add comments
Merge pull request #42 from callahad/sts

adds STS header