Move hsts check back to resource-request-starting (#146).