Don't redirect hostmeta requests to http if httpsOnly flag is set
Don't follow redirects to insecure URLs for /.well-known/webfinger endpoint