rails/rails — pull request #11065 by gbuesing (2013-06-24 01:11:35+00:00)
Title: ActionDispatch:SSL: don't include STS header in non-https responses

Reason: the STS spec explicitly says:

"An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport."

http://tools.ietf.org/html/draft-ietf-websec-strict-transport-sec-14#section-7.2