Don't send HSTS headers over non-HTTPS connections

This fixes #5.