Disable includeSubDomains in SSL config until wider coverage

This can cause some strange issues if we aren't prepped for it.
Add a few more static filetypes to avoid running through PHP