Despite configuring Django to add the HSTS headers, it's not present in Horizon responses when accessed from the outside. It's possible that it is being removed by HAProxy.

We need to make sure HAProxy is configured either to pass those headers, or to add them itself.