Enable HSTS for TLS connections

Don't use X-Frame-Options: deny for now