[Don't Merge] Set HSTS in the headers.

Related to #1460. Don't merge.

Just to try it out, I set the `Strict-Transport-Security` header. It doesn't seem to work on arbitrary ports. This is better used by nginx or another proxy to set up the right connections (when serving off of 80+443).

I'll be closing this just as quickly as I opened this.