add HSTS header and set cookies to secure