Make sure you also set the Strict-Transport-Security header to prevent attacks against the HTTP-to-HTTPS redirect.