updates password reset to use config host
hardhttps@0.0.3
Set HSTS header properly

npm/security#5