remove strict-transport-security header