hardhttps@0.0.3
Set HSTS header properly

npm/security#5
updates password reset to use config host