Redirect http => https where possible ; add HSTS headers

[patrickod]

In the following set of steps:

1. navigate to root URL over plaintext HTTP
2. complete oauth flow
3. are redirected back to https:// callback URL

you'll be greeted with a 404 as the request handler is unable to read the auth_url out of the session cookie since in step 1 it was set on a cookie with the secure parameter meaning that it's dropped by the browser.

We should pre-empt this and redirect all http requests to https first, and also set HSTS headers to prevent subsequent visits from hitting this redirect.