added Strict-Transport-Security header