Add Strict-Transport-Security header and http->https redirect