feat(nginx): use h5bp best-practices for nginx setup