ripped out strict-transport-security for testing with self-signed certs