Use http.Transport instead of http.Client.

http.Client follows redirects by default and has support for cookies.
http.Transport only performs one round-trip. Using http.Client is
vulnerable to bad behaviour if there's a redirect loop somewhere in your
app. Since we don't need (or want) redirects, and don't use cookies,
http.Transport seems like the most logical choice.

(Before this patch, we ended up DOSing our own site whenever someone discovered a redirect loop)