Move README info about sec headers, clean up .env file, set HSTS disabled to true for devs