Default Strict Transport Security when using HTTPS

[aantron]

• Emit the header from Dream.html.
• Provide guidance, and link to information about HSTS preload (but don't enable it). Potentially use the same as example as for CSP (Default Strict Transport Security when using HTTPS #49).
• HSTS should probably be off on localhost.
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
• https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html