As per spec, don't include STS header in non-https responses

The STS spec explicitly says:

"An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport."

http://tools.ietf.org/html/draft-ietf-websec-strict-transport-sec-14#section-7.2