Increased SECURE_HSTS_SECONDS to a year and enabled it for subdomains.