[Bug 748314] set Strict-transport-security http header