Fix redirect logic.

Simplify redirect logic to make it more predictable, and only attempt to move a non-SSL location to a SSL-enabled location at the requested host and port.