add Strict-Transport-Security and https redirects