Do a double-request to test out Strict Transport

[konklone]

So that it can be done in one go, without refreshing the page for a new client. This shouldn't be that hard. I should be able to take what's in the hsts branch and merge it in. It'll just be annoying to retake all the screenshots.

[konklone]

The first request will need to be of the <script> variety, so that it's guaranteed to succeed - this can then trigger a second <script> request, and a CORS request, both of which should then skip right to HTTPS without a redirect.