fix: set HSTS preload attribute to false by default

See <https://hstspreload.org/#opt-in> for more information
why this is important.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>

lib/config/default.js

@@ -15,7 +15,7 @@ module.exports = {
     enable: true,
     maxAgeSeconds: 60 * 60 * 24 * 365,
     includeSubdomains: true,
-    preload: true
+    preload: false
   },
   csp: {
     enable: true,