Issue #223 - add STS header

* According to spec, this should be ignored if the page is HTTP to
  begin with.
Added UserID to debugging output

* Fail on verified assertion not having email. because that appears to
  be a thing.
Merge pull request #231 from jrconlin/dev

Issue #223, Add UserID to debug output