HSTS header updates

* Without 'always' the header would not be included on non-2xx responses (i.e. a redirect)
* 'set' replaces 'add' forcing Apache to be the source of truth and avoids HTTP header injection attacks at the application level
* Clarify the example so it can be copy/pasted