update nginx cipher list to Mozilla's current intermediate ciphers and update HSTS header to be six months

* The Mozilla recommendations must have been updated in the last few years.
* The HSTS header must have >=6 months to get an A+ at ssllabs.com/ssltest.