FIX: Disable Strict-Transport-Security from "Redirect secure"

Strict-Transport-Security is quite hard to remove. So it is disabled by default.
FIX: inheriting limits during configuration.