josh/rack-ssl — pull request #27 by gbuesing (2013-06-24 02:09:17+00:00)
Title: As per spec, don't include STS header in non-https responses

The STS spec explicitly says:

"An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport."

http://tools.ietf.org/html/draft-ietf-websec-strict-transport-sec-14#section-7.2