Fix redirect; add HSTS