Add Strict Transport Security to HTTPS-only sites

See https://www.drupal.org/node/986312 for the original issue.