Force redirection of /status.png over HTTPS

Since we're most likely behind a reverse proxy, we have no knowledge
about the scheme that is used on the user end, we only see the scheme
that the rproxy uses to connect to us. As it is hard to determine if
the connection to the user was HTTP or HTTPS, we rather redirect to the
HTTPS version in every case, so browsers do not complain about insecure
HTTPS connections when /status.png is fetched over HTTP. Yes, it's only
a redirect, but an attacker could still tamper with the Location header.