Add redirection & cookie support to HSTS plugin

Handle servers that redirect the client before setting the HSTS header. e.g. some applications behind a WAF