added middleware to redirect to HTTPS and set HSTS. Fixes #3.