More secure nginx config (HSTS + iframe disallow) + fix caching