web/security: Fix typo on h2 tag