adds STS header

- also some re-ordering of middlewares, based on what should happen
first

fixes #38