Only send the hsts header if the scheme of the call is https

Heya

Picked up the Nuget package and noticed that it didn't conform completely to the RFC6797 spec so I fixed that little part.
According to the spec [section 7.2](http://tools.ietf.org/html/rfc6797#section-7.2) 

*"An HSTS Host MUST NOT include the STS header field in HTTP responses
   conveyed over non-secure transport."*

Hope you can use it :-)

**Changes**
- Only send header for https
- Added unit tests to test https only functionality.
- Added two more unit tests to test the overwrite branch in the Callback Action.