Don't pass the Strict-Transport-Security header from upstream.

We set it in the proxy anyway, don't send 2 Strict-Transport-Security
headers.