Changes

HSTS: propagate enabled state for HTTPS URLs, too
While we have no need to transform the URL in the HTTPS case, the HSTS
policy should still result in a hard failure when something is untoward
(i.e. not providing the user with a way to proceed). Ensure this is so.