apache: enable HSTS, closes #40