enable HSTS for two years

Header always set Strict-Transport-Security