Don't send HSTS headers over non-HTTPS connections.

This fixes #6.
Merge pull request #8 from nvie/master

Don't send HSTS headers over non-HTTPS connections