add hsts; sync html/xhr/fetch