ActionDispatch:SSL: don't include STS header in non-https responses
Merge pull request #11065 from gbuesing/hstsfix

ActionDispatch:SSL: don't include STS header in non-https responses