Only set HSTS header for unsecure connections