Add HSTS response header
Add HSTS response header

Since we’re redirecting all insecure requests anyway, enforcing this at
the client seems like it’s not a bad idea

PRX/play.prx.org,PRX/play.prx.org,PRX/play.prx.org,PRX/play.prx.org