Remove the ssl_options config option. Let nginx handle HSTS and http->https redirects instead. At the rails level, all we need to do is set the secure cookie flag when https is enabled (which we assume it's enabled in production).