ocf_www: use https for all websites

This also enables HSTS for the www.ocf.berkeley.edu domain.