blog: set Strict-Transport-Security header

Change-Id: I06942c139689d3bc50da5fc367963fe01801518c
Reviewed-on: https://go-review.googlesource.com/22675
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
diff --git a/blog/appengine.go b/blog/appengine.go
index 12bcdf2..288247e 100644
--- a/blog/appengine.go
+++ b/blog/appengine.go
@@ -21,5 +21,8 @@
 	if err != nil {
 		panic(err)
 	}
-	http.Handle("/", s)
+	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Strict-Transport-Security", "max-age=31536000; preload")
+		s.ServeHTTP(w, r)
+	})
 }