Removed "includeSubDomains"

As a best practice, Nginx should only direct clients to use the certificate on specified domains. This is because not all servers using other subdomains necessarily listen on 443 and because, unless it is a wildcard certificate, it likely won't be valid on subdomains other than WWW.
HSTS off by default

Consensus to disable HSTS by default.
Merge pull request #68 from DanielMarquard/patch-1

Removed includeSubDomains, and disable HTST by default