title: Set Strict-Transport-Security header for API
body: <p>Does it make sense to set the <code>Strict-Transport-Security</code> header for API responses <em>(i.e. requests that don't maintain state)</em> and most likely don't originate from browsers.</p>