Strict-Transport-Security should not include subdomains Fix #28