force HTTPS, add HSTS, other misc security tweaks
Rules to serve index.html for URLs that don't match a file or a directory (needed for loading a non-home URL)