Redirect to SSL; add transport security header