Force HTTPS via HSTS if configured