added optional SSL_KEY, SSL_CERT env vars to enable HTTPS for development.
enable HSTS if we're on HTTPS.