fix(hsts): force hsts headers and use milliseconds

helmet API changes require us to set `force: true` or else the header won't show up. In addition, `max-age` uses milliseconds now.

Fixes #1614
how does it know to do it in ms?