Update StrictTransportSecurityAttribute - use set instead of add HTTP header.