non http 301 redirect
enforce Strict-Transport-Security