<% response.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload"); %>