give Steve Dower access to downloads
Implement HPKP, defaulting to off with a 15 second max-age