hsts: secure `request.resource_url()` as well.
release: `v0.10.1`.