Is there an HTTP Response header that disallows any non-SSL content from being displayed on the current page?
The idea is some times external content that needs to be on the website (cough, ad engines, cough) may be slacking off with the SSL and in such a case I'd rather skip on this external content, than provide an opportunity for active MitM with all its consequences.
I know HSTS covers similar ground, but AFAIK it works on a host basis; that is sending HSTS means you indicate you want only HTTPS connections to your host, not that you won't be including non-HTTPS content from the HTML of your pages.