use req.secure or honor https from x-forwarded-proto when setting hsts header