Factor out headers, add Strict-Transport-Security