Add HSTS filter with a filter to ensure it only gets set for HTTPS requests as per the RFC.