Add Strict-Transport-Security header to response