disable HTTP Trace

found vulnerability by InfoSec that default setting enables HTTP Trace