The HSTS response header was delivered without the max-age flag.