enabling HSTS, except for /invites/ pages (not ideal, but at least it works)