Set HSTS to 1 year

@mvgijssel

Fixes https://hackerone.com/reports/15518