move "Strict HTTPS" last since now it is built-in the browser