Merge pull request #11069 from ykzts/actiondispatch-ssl-secure-flag-igonore-case

Flag cookies as secure with ignore case in ActionDispatch::SSL
Merge pull request #11065 from gbuesing/hstsfix

ActionDispatch:SSL: don't include STS header in non-https responses