bugfix: +sts command re-implemented
+hsts implies --http