Disallow redirects in discovery (rationale below)

Redirects seem awesome. They dramatically simplify delegation and they're part
of the HTTP spec. On the other hand, it makes it really easy to shoot yourself
in the foot when dealing with redirections to insecure HTTP locations.

To wit, verifiers have to inspect every step in the redirect chain and ensure
they stay on TLS. Most HTTP libraries only provide an easy boolean to
"allow_redirects" or not, which means library authors would have to kludge
together something to handle that inspection.

It's much easier to get it correct when that just means setting
"allow_redirects" to false.