Add exclude option

lib/rack/ssl.rb

@@ -15,10 +15,14 @@ def initialize(app, options = {})
       @hsts = options[:hsts]
       @hsts = {} if @hsts.nil? || @hsts == true
       @hsts = self.class.default_hsts_options.merge(@hsts) if @hsts
+
+      @exclude = options[:exclude]
     end
 
     def call(env)
-      if scheme(env) == 'https'
+      if @exclude && @exclude.call(env)
+        @app.call(env)
+      elsif scheme(env) == 'https'
         status, headers, body = @app.call(env)
         headers = hsts_headers.merge(headers)
         flag_cookies_as_secure!(headers)

test/test_ssl.rb

@@ -36,6 +36,12 @@ def test_redirects_http_to_https
       last_response.headers['Location']
   end
 
+  def test_exclude_from_redirect
+    self.app = Rack::SSL.new(default_app, :exclude => lambda { |env| true })
+    get "http://example.org/"
+    assert last_response.ok?
+  end
+
   def test_hsts_header_by_default
     get "https://example.org/"
     assert_equal "max-age=31536000",