Issue #223 - add STS header

* According to spec, this should be ignored if the page is HTTP to
  begin with.
Update to comment on default branch shift

tl;dr: dev is the new default. Master is still the most stable.
Added UserID to debugging output

* Fail on verified assertion not having email. because that appears to
  be a thing.
Merge pull request #231 from jrconlin/dev

Issue #223, Add UserID to debug output
Merge branch 'dev' into functional-test-madness