Security tweaks.

- Remove X-Powered-By header. No need to advertise.
- Add Strict-Transport-Security header.