I will admit to deploying an app into production and leaving it there for weeks before realizing that authenticated traffic was being transported un-secured HTTP. I'd been operating under the false assumption that `config.force_ssl` would be `true` in production by default for new apps.

Suggesting this change to gauge interest and start a conversation. Since this option was introduced, the state of the web has really changed with Let's Encrypt certificates, and HTTPS has become table stakes for most hosting services. It feels like the time is right to enable Strict-Transport-Security by default for new apps.

Co-authored-by: Aaron Patterson <aaron@rubyonrails.org>
Co-authored-by: Guillermo Iguaran <guilleiguaran@gmail.com>
Co-authored-by: vinibispo <vini.bispo015@gmail.com>