Look into HSTS headers

[johnthepink]

via https://github.com/NewSpring/newwwspring.cc/issues/219

[johnthepink]

We should be able to do this, just be careful with TTL.

I ran in to an issue with this once because Rails has a force_ssl config which enables HSTS with a TTL of one year. bye bye http forever