No shell scripts to check.

It could lead to a case where the site is effectively offline.

Still, it will there in the image. That's fine with me.

- Replace file with configuration snippet.
- Allow some domains, disallow others.

We set it in the proxy anyway, don't send 2 Strict-Transport-Security
headers.