Add HSTS headers.

* Helmet only adds HSTS headers in https mode.
* max-age set to 6 months.

fixes #208