properly check for https during HSTS insertion

We want consistent behavior for deciding whether the
current connetion is using https, so we should use the
same logic as the https redirect check.