HSTS on wordpress.tv

Per a hackerone.com report, we need to get HSTS setup on wordpress.tv. The alternative being setting the secure only flag for the auth cookies.

#prio2