Issue #223 - add STS header

* According to spec, this should be ignored if the page is HTTP to
  begin with.