Display HSTS headers only when HTTPS is used