HSTS Not Set
I have the following Koa Helmet setup in my app and I'm not receiving the HSTS header as I would expect. 
### HTTP Response

```
HTTP/1.1 200 OK
Content-Security-Policy-Report-Only: default-src 'none'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self'; sandbox allow-forms allow-scripts; object-src; connect-src 'self'; report-uri https://domain.com
Content-Type: application/json; charset=utf-8
Date: Mon, 17 Oct 2016 01:38:18 GMT
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Content-Length: 729
Connection: Close
```
### Code

```
var helmet = require('koa-helmet')
...
// use default helmet settings
app.use(helmet())

app.use(helmet.contentSecurityPolicy({
  // Specify directives as normal.
  directives: {
    defaultSrc: ["'none'"],
    scriptSrc: ["'self' 'unsafe-eval'"],
    styleSrc: ["'self' 'unsafe-inline'"],
    imgSrc: ["'self'"],
    sandbox: ['allow-forms', 'allow-scripts'],
    objectSrc: [], // An empty array allows nothing through
    'connect-src': ["'self'"],
    reportUri: 'https://<domain>.com'
  },

  // Set to true if you only want browsers to report errors, not block them
  reportOnly: true,

  // Set to true if you want to blindly set all headers: Content-Security-Policy,
  // X-WebKit-CSP, and X-Content-Security-Policy.
  setAllHeaders: false,

  // Set to true if you want to disable CSP on Android where it can be buggy.
  disableAndroid: false,

  // Set to false if you want to completely disable any user-agent sniffing.
  // This may make the headers less compatible but it will be much faster.
  // This defaults to `true`.
  browserSniff: true
}))
```
