fix(hsts): force hsts headers and use milliseconds

helmet API changes require us to set `force: true` or else the header won't show up. In addition, `max-age` uses milliseconds now.

Fixes #1614
It uses [moment.js](http://momentjs.com/docs/#/durations/) under the hood for the `duration` format, which outputs milliseconds.