always serve content over HTTPS, add Strict-Transport-Security header to initial page load response
start using com.google.common.truth in tests