redirect all HTTP to HTTPS and enable HSTS, closes #18