Add trested URL to http-sec-headers

[freb]

I had some inconsistent results with one host i tested, it would be nice to see in the output exactly what URL was used to ensure the hostname was hit and not the ip address.