Use Hapi's builtin config for the Strict-Transport-Security header

the header value includeSubdomains was not set before, what do you want to see here?