Use Hapi's builtin config for the Strict-Transport-Security header

please see https://github.com/mozilla/fxa-auth-server/blob/master/server/server.js#L181 for further reference