STS headers to all requests when not in local development: issue #11