Force http traffic to fall over to https addresses with HSTS in IIS.

This Scott Hanselman blog posting explains how to do it. It looks like a Web.config orchestration to me.