Add support for HTTP Strict Transport Security about security

[Tratcher]

Side note: Your implementation won't work in many scenarios.
https://github.com/sblackler/Owin.Hsts/blob/master/Owin.Hsts/HstsMiddleware.cs#L27

The response headers can be sent during the call to Next, so changes done after Next may fail. You should move all that logic to the OnSendingHeaders event. See http://owin.org/spec/CommonKeys.html

Ah, I didn't realise that was there. I'll fix that this evening when I get a chance.

Updated to use OnSendingHeaders (commit: https://github.com/sblackler/Owin.Hsts/commit/f69e78df94ccfabc1fd8000717717cf42d9201b7)

[Eilon]

@blowdart

[blowdart]

Given multiple implementations, including nwebsec from @klings I don't feel providing a more limited middleware is that useful.

@blowdart thanks for the info about nwebsec. Didn't realise that existed (don't know if it did a year a go when I started this). I think it would be good to raise awareness for stuff like this, maybe through a blog post or something? :)

[blowdart]

That would be a good idea. I'll find someone that blogs and poke them with a stick.

[StefanOssendorf]

Or https://github.com/StefanOssendorf/SecurityHeadersMiddleware/ ;-)