Issue #223 - add STS header

* According to spec, this should be ignored if the page is HTTP to
  begin with.
Update to comment on default branch shift

tl;dr: dev is the new default. Master is still the most stable.
Added UserID to debugging output

* Fail on verified assertion not having email. because that appears to
  be a thing.
Merge pull request #231 from jrconlin/dev

Issue #223, Add UserID to debug output
Exit on critical config misses

* If session secret or db connect errors, die.
Remove device if erased.

* page refresh required before UI will no longer show current device
Merge branch 'dev' of github.com:mozilla-services/FindMyDevice into dev
Merge pull request #236 from jrconlin/dev

Issue #232; #235
Merge pull request #238 from mozilla-services/dev

Merging from Dev