Adding a note about an App Engine bug which silently strips HSTS headers on custom domains.