Increase max-age for HSTS to recommended default

[wwuck]

HSTS is now supported by all the major browsers

http://caniuse.com/#search=Strict%20Transport%20Security

[ChrisMcKee]

Hi,
15768000 = 6 months; which is recommended as part of the Mozilla Security standards / generator https://mozilla.github.io/server-side-tls/ssl-config-generator/ , https://wiki.mozilla.org/Security/Server_Side_TLS#HSTS:_HTTP_Strict_Transport_Security
I
There's not really much to lose or gain increasing to 12 months; but I'll accept that the section on HSTS needs expanding to include a mention of preload + include subdomains. Subdomains was left out intentionally as at the time it was common for people to use "azure cloud services" which had a default azure domain but didn't support ssl. Setting subdomains would break all the other sites living under the main domain.

I won't merge this as I'll have to apply the change across all of the other files but i'll leave it open as a ref.

Thanks!