Use Strict-Transport-Security header

As James
I would like my browser to remember to use HTTPS
So that I don’t feel stupid when I forget to type https:// in the
address bar

I haven't been able to test this properly yet.

`vagrant up ci-master-1` does not result in nginx being installed.

Pointers appreciated.