I was playing around with this site:
https://www.trustworthyinternet.org/ssl-pulse/ and noticed that my app engine site, (which gets an A, well done Google but I expect nothing less :-) wasn't listed as supporting HSTS when I thought it did. So I investigated and found that my HSTS header which used to work doesn't work any more. I have no idea when it stopped working, need to add it my test suite.
thanks.