Enable HSTS for all apache served SSL sites

This enables [HTTP Strict Transport Security](http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) for all our apache served SSL sites.

This basically means that we tell the browser to default to using https for those sites even if the user types http, until a given expiry date. Currently I have set that 180 days but that is open for discussion.