fix(hsts): force hsts headers and use milliseconds

helmet API changes require us to set `force: true` or else the header won't show up. In addition, `max-age` uses milliseconds now.

Fixes #1614
`convict` knows how to convert string representations to milliseconds.