remove Strict-Transport-Security header from responses