mozilla/fxa-oauth-server — pull request #154 by jrgm (2014-10-14 03:28:19+00:00)
Title: set HSTS header for 180 days, but do not set the other HAPI security headers (e.g., x-download-options)

Hi @seanmonstar. We discussed this in La-la-land, and I believe it was to set HSTS but not the rest. If I misunderstood, I can revise this PR. (Also, I'll make a similar PR for fxa-profile-server like this one if this one is agreeable).