add includeSubDomains and preload flags to HSTS header