That question came up during security review. We should enforce HSTS at least
for the password leak check API. However, it's benificial to enforce it for all
possible APIs.
Bug: 1049177
Change-Id: Ieacb6675c195c89606cc3a8d956bdfa855b8b64f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2057125
Commit-Queue: Vasilii Sukhanov <vasilii@chromium.org>
Commit-Queue: Nick Harper <nharper@chromium.org>
Reviewed-by: Nick Harper <nharper@chromium.org>
Cr-Commit-Position: refs/heads/master@{#741576}