set Pragma, Cache-Control, Expires headers
spec response headers are correct
set config.force_ssl = true for production env
fixed header value to be a string
turned force_ssl off - when turned on server currently redirects request in a way that will never complete
updated service restart instructions in readme
turn force_ssl back on
Merge pull request #295 from ministryofjustice/security_improvements

Security improvements