Question for #infosec folks here.

Are there sound reasons for a web site to ever have both of these things in combination?

- No Content Security Policy headers; paired with
- The following Strict Transport Security header:

strict-transport-security: max-age=0; includeSubDomains; preload

These both seem like Very Bad Ideas. Is there some arcane wizardry that makes these choices -- individually or together -- okay?