use USE_SSL config setting to enable/disable SSL
allow init_app to specify hsts settings too