only hsts if connection is secure