Don't include subdomains in HSTS

e.g. doc.crates.io doesn't want to be included