add HSTS header

since this service is intended to be HTTPS only, HSTS is another way of helping to ensure that.