quickstart: disable HSTS headers for self-signed certificates

[calebdoxsey]

Is your feature request related to a problem? Please describe.

We add these headers automatically to responses:

		"X-Frame-Options":           "SAMEORIGIN",
		"X-XSS-Protection":          "1; mode=block",
		"Strict-Transport-Security": "max-age=31536000; includeSubDomains; preload",

These make sense for valid certificates, but they are very annoying for invalid certificates, because we may end up pinning a generated self-signed certificate and the user has to manually clear the cache.

Describe the solution you'd like

We should only add these headers (by default) for routes with valid certificates.

Describe alternatives you've considered

Explain any additional use-cases

If there are any use-cases that would help us understand the use/need/value please share them as they can help us decide on acceptance and prioritization.

Additional context

Add any other context or screenshots about the feature request here.