Add HSTS header for sites served over HTTPS.

NOTE: you will probably want to test this change with your site. You want the
Strict-Transport-Security header to be set iff the site is served over SSL.