only set HSTS on index.html