tdmalone Fix invalid max-age for HSTS; add basic CSP