HSTS checker chases redirects, gives misleading results

[ericlaw1979]

moarTLS incorrectly reports that go.microsoft.com is advertising HSTS policy.

`GET http://go.microsoft.com/fwlink/?LinkID=530144 302 Redirect to https://www.microsoft.com/en-us/servicesagreement/

GET https://www.microsoft.com/en-us/servicesagreement/ Strict-Transport-Security: max-age=31536000 200 OK (text/html)`

To fix this, we need to resolve the TODO and use the fetch API instead.

[ericlaw1979]

Sadly, fetch() doesn't today support timeouts: https://github.com/whatwg/fetch/issues/20

For XHR, we can at least check the final URL before indicating HSTS support. http.onreadystatechange = function() { if (this.readyState === this.DONE) { console.log(this.responseURL); }