fix(hsts): force hsts headers and use milliseconds

helmet API changes require us to set `force: true` or else the header won't show up. In addition, `max-age` uses milliseconds now.

@ckarlof r?