Use Hapi's builtin config for the Strict-Transport-Security header

This is currently less than the current `max-age` value on production (15552000).

Also, it's missing the `includeSubdomains` option.