allow strict transport if ssl is on and stop x-frame-options, this might break embedded pads, please test
Enable HSTS for TLS connections

Don't use X-Frame-Options: deny for now
Merge pull request #1619 from ether/stricter-transport

Enable HSTS on TLS connections