set HSTS header for 180 days, but do not set the other HAPI security headers (e.g., x-download-options)
Merge pull request #154 from jrgm/use-hsts

set HSTS header for 180 days, but do not set the other HAPI security headers (e.g., x-download-options)