sharpen the description for HSTS and CSP

[drwetter]

• CSP sounded too promising and easy going to me. Also the frame-ancestor option is worth to mention explicitly
• HSTS was amended using the term browser right in the beginning and added max-age in the description.

For the term browser: maybe we should mention some place else that this tab is for browsers only. I've seen folks believing that e.g. non-browser API clients honor HSTS instead of switching off clear text HTTP on the server side.

[righettod]

Hi, Thanks a lot for the PR and its content. I will review it ASAP and add the point about the browser. Have a great weekend. Dom

[righettod]

Very nice enhancements. Thanks a lot @drwetter 👍
I validated the PR, @riramar you can merge it when you want 💯
@drwetter / @riramar Once it will be me merged, I will add the suggestion from Dirk about explicitly mentioning that specified headers are for browsers.

[righettod]

Very nice enhancements. Thanks a lot @drwetter 👍 I validated the PR, @riramar you can merge it when you want 💯 @drwetter / @riramar Once it will be me merged, I will add the suggestion from Dirk about explicitly mentioning that specified headers are for browsers.

Suggestion proposed in PR #198