Consider adding an option to set Strict-Transport-Security header in web.xml

Transparent redirection to HTTPS means that the vast majority of the time your users are on your site, they'll be using a secure connection. It does, however, leave a small window of opportunity for attack: the initial HTTP connection is wide open, vulnerable to [SSL stripping](http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security#Applicability) and related attacks. Given that a man in the middle has complete access to the initial HTTP request, it can act as a proxy between you and the server, keeping you on an insecure HTTP connection regardless of the server's intentions.

You can mitigate the risk of this class of attack by asking the browser to enforce [HTTP Strict Transport Security (HSTS)](http://tools.ietf.org/html/rfc6797). Sending the Strict-Transport-Security HTTP header instructs the browser to do the HTTP to HTTPS redirection _client-side_, without ever touching the network (this also happens to be great for performance; the best request is the one you don't have to make).

Please consider adding an option to set this header in web.xml.

Start by reviewing the web.xml configuration area and RFC 6797 to understand the requested Strict-Transport-Security behavior. Determine the configuration shape and its interaction with HTTPS redirection; done means web.xml can request the header and the resulting behavior is covered by the project’s relevant checks.

Written by the indexing model from the issue text.