As per spec, don't include STS header in non-https responses
Merge pull request #27 from gbuesing/hstsfix

As per spec, don't include STS header in non-https responses