set HSTS header for 180 days, but do not set the other HAPI security headers (e.g., x-download-options)

Hi @seanmonstar. We discussed this in La-la-land, and I believe it was to set HSTS but not the rest. If I misunderstood, I can revise this PR. (Also, I'll make a similar PR for fxa-profile-server like this one if this one is agreeable).