Add HSTS headers.

* Helmet only adds HSTS headers in https mode.

fixes #208
Merge pull request #227 from mozilla/issue-208-sts-headers

Add HSTS headers.