allow strict transport if ssl is on and stop x-frame-options, this might...

... break embedded pads, please test