Checking HSTS directive value in the plugin. See #3.

We are still unable to write tests for local servers because curl has to
be know our self-signed cert.