nginx exclusively adds HSTS headers