hsts: secure the `request.application_url` property.
release: `v0.10`.