[Bug 748314] New: set Strict-transport-security http header